[SQL injection] extended injection method

1、 Wide byte Injection

Wide byte injection is not exactly an injection method , But another special case . The purpose of wide byte injection is to escape around single and double quotation marks , With sqli-labs-32 Guan as an example

analysis ：

You can see it in this interface , The characters we entered , Is encoded

The encoding format is hexadecimal of decimal digits of corresponding characters

When we check whether there are injection points , The system escaped our single quotation marks , It's through \ Escaped

Then it was coded by the system

  resolvent ：

Because this code is encoded by hexadecimal , We can do that by using “ Eat the backslash way ” To inject

namely , Inject one more encoded character into this value , Let its backslash form garbled

After closing , It is found that the following syntax can be executed

https://192.168.79.147/sqli-labs/Less-32/?id=1%81' and 1=2 union select 1,version(),database() --+

2、Cookie Inject

The injection point is Cookie In the data , With sqli-labs-20 Guan as an example .

Use Burp Suite Grab the bag , I found that there was a wrong report , And the parameter we entered appears in the error report , It can be concluded that it is character injection , Single quote closure

Echo point found , Using federated queries

Found that you can find

3、base64 Inject

Need to carry out base64 code , take Cookie The values in base64 After the coding , To perform

Perform injection tests , I found that when using double quotation marks , Error message , And it's character injection

Use statements for joint queries , Found echo point

At this time, you can query information

Coding process

  success

 4、User-Agent Inject

18 Turn off

 

5、Referer Inject

You can know from the page information that this is a Referer Inject

  You can see that it is a string that needs to be paired

Because there is an error message , You can use error injection

 Referer: atzxc' and updatexml(1,concat(0x5e,(select version()),0x5e),1) and '1

Find out the database information