3_SQL注入攻击_1

时间:2021-07-28 02:43:05

0x00 sql注入
  在owasp的年度top10安全问题中,注入高居榜首。SQL注入攻击是指通过构建特殊的输入作为参数传入web应用程序,而这些输入大多都是SQL语法中的一些组合,通过执行SQL语句而执行攻击者所要的操作,其主要原因是程序没有细致的过滤用户输入的数据,致使非法数据侵入系统。
1.对web应用而言,用户的核心数据存储在数据库中,例如MySQL,SQL sever,oracle;
2.通过SQL注入攻击,可以获取,修改,删除数据库信息,并且通过提权来控制web服务器等其他操作;
3.SQL注入即攻击者通过构造特殊的SQL语句,入侵目标系统,致使后台数据库泄露数据的过程;
4.因为SQL注入漏洞造成的严重危害性所以,常年稳居owasp top10的榜首。

 

0x01 SQL注入的危害

 1.脱库导致用户数据泄露;

 2.危害web等应用的安全;

 3.失去操作系统的控制权;

 4.用户信息被非法买卖;

 5.危害企业及国家的安全;

0x02 SQL基础知识回顾

  环境:OWASP

  表1:dvwa.user

  表2:wordpress.wp_users

  表3: mysql.user

登录

mysql -uroot -p
root@owaspbwa:~# mysql -uroot -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or g.
Your MySQL connection id is 579
Server version: 5.1.41-3ubuntu12.6-log (Ubuntu)

Type help; or h for help. Type c to clear the current input statement.

mysql> 

显示数据库

mysql> show databases;
 -------------------- 
| Database           |
 -------------------- 
| information_schema |
| .svn               |
| bricks             |
| bwapp              |
| citizens           |
| cryptomg           |
| dvwa               |
| gallery2           |
| getboo             |
| ghost              |
| gtd-php            |
| hex                |
| isp                |
| joomla             |
| mutillidae         |
| mysql              |
| nowasp             |
| orangehrm          |
| personalblog       |
| peruggia           |
| phpbb              |
| phpmyadmin         |
| proxy              |
| rentnet            |
| sqlol              |
| tikiwiki           |
| vicnum             |
| wackopicko         |
| wavsepdb           |
| webcal             |
| webgoat_coins      |
| wordpress          |
| wraithlogin        |
| yazd               |
 -------------------- 
34 rows in set (0.56 sec)

返回所在的库

mysql> select database();
 ------------ 
| database() |
 ------------ 
| NULL       |
 ------------ 

返回当前用户

mysql> select user();
 ---------------- 
| user()         |
 ---------------- 
| root@localhost |
 ---------------- 

返回当前时间

mysql> select now();
 --------------------- 
| now()               |
 --------------------- 
| 2020-01-17 05:26:10 |
 --------------------- 

进入或切换一个数据库

mysql> use dvwa;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed

  现在再查看当前的库: 

mysql> select database();
 ------------ 
| database() |
 ------------ 
| dvwa       |
 ------------ 

查看表

mysql> show tables;
 ---------------- 
| Tables_in_dvwa |
 ---------------- 
| guestbook      |
| users          |
 ---------------- 

查看具体表的结构

mysql> desc users;
 ------------ ------------- ------ ----- --------- ------- 
| Field      | Type        | Null | Key | Default | Extra |
 ------------ ------------- ------ ----- --------- ------- 
| user_id    | int(6)      | NO   | PRI | 0       |       |
| first_name | varchar(15) | YES  |     | NULL    |       |
| last_name  | varchar(15) | YES  |     | NULL    |       |
| user       | varchar(15) | YES  |     | NULL    |       |
| password   | varchar(32) | YES  |     | NULL    |       |
| avatar     | varchar(70) | YES  |     | NULL    |       |
 ------------ ------------- ------ ----- --------- ------- 
DESC      DESCRIBE  
mysql> DESCRIBE users;
 ------------ ------------- ------ ----- --------- ------- 
| Field      | Type        | Null | Key | Default | Extra |
 ------------ ------------- ------ ----- --------- ------- 
| user_id    | int(6)      | NO   | PRI | 0       |       |
| first_name | varchar(15) | YES  |     | NULL    |       |
| last_name  | varchar(15) | YES  |     | NULL    |       |
| user       | varchar(15) | YES  |     | NULL    |       |
| password   | varchar(32) | YES  |     | NULL    |       |
| avatar     | varchar(70) | YES  |     | NULL    |       |
 ------------ ------------- ------ ----- --------- ------- 

Field :字段,通常指的是我们所说的列;例如上表就有六个字段;user_id等等

Type :   字段的类型和长度

Null :字段是否可以为空

Key :主键,外键,或者是索引

Default: 字段的默认值

Extra:附加的属性

 

显示创建表的结构

mysql> show create table usersG;
*************************** 1. row ***************************
       Table: users
Create Table: CREATE TABLE `users` (
  `user_id` int(6) NOT NULL DEFAULT 0,
  `first_name` varchar(15) DEFAULT NULL,
  `last_name` varchar(15) DEFAULT NULL,
  `user` varchar(15) DEFAULT NULL,
  `password` varchar(32) DEFAULT NULL,
  `avatar` varchar(70) DEFAULT NULL,
  PRIMARY KEY (`user_id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1

查询表的记录

mysql> select * from users;
 --------- ------------ ----------- --------- ---------------------------------- -------------------------------------------------- 
| user_id | first_name | last_name | user    | password                         | avatar                                           |
 --------- ------------ ----------- --------- ---------------------------------- -------------------------------------------------- 
|       1 | admin      | admin     | admin   | 21232f297a57a5a743894a0e4a801fc3 | http://127.0.0.1/dvwa/hackable/users/admin.jpg   |
|       2 | Gordon     | Brown     | gordonb | e99a18c428cb38d5f260853678922e03 | http://127.0.0.1/dvwa/hackable/users/gordonb.jpg |
|       3 | Hack       | Me        | 1337    | 8d3533d75ae2c3966d7e0d4fcc69216b | http://127.0.0.1/dvwa/hackable/users/1337.jpg    |
|       4 | Pablo      | Picasso   | pablo   | 0d107d09f5bbe40cade3de5c71e9e9b7 | http://127.0.0.1/dvwa/hackable/users/pablo.jpg   |
|       5 | Bob        | Smith     | smithy  | 5f4dcc3b5aa765d61d8327deb882cf99 | http://127.0.0.1/dvwa/hackable/users/smithy.jpg  |
|       6 | user       | user      | user    | ee11cbb19052e40b07aac0ca060c23ee | http://127.0.0.1/dvwa/hackable/users/1337.jpg    |
 --------- ------------ ----------- --------- ---------------------------------- -------------------------------------------------- 
6 rows in set (0.10 sec)

查询指定的字段

mysql> select user,user_id,password from users;
 --------- --------- ---------------------------------- 
| user    | user_id | password                         |
 --------- --------- ---------------------------------- 
| admin   |       1 | 21232f297a57a5a743894a0e4a801fc3 |
| gordonb |       2 | e99a18c428cb38d5f260853678922e03 |
| 1337    |       3 | 8d3533d75ae2c3966d7e0d4fcc69216b |
| pablo   |       4 | 0d107d09f5bbe40cade3de5c71e9e9b7 |
| smithy  |       5 | 5f4dcc3b5aa765d61d8327deb882cf99 |
| user    |       6 | ee11cbb19052e40b07aac0ca060c23ee |
 --------- --------- ---------------------------------- 

查询其他库

mysql> desc mysql.user;
 ----------------------- ----------------------------------- ------ ----- --------- ------- 
| Field                 | Type                              | Null | Key | Default | Extra |
 ----------------------- ----------------------------------- ------ ----- --------- ------- 
| Host                  | char(60)                          | NO   | PRI |         |       |
| User                  | char(16)                          | NO   | PRI |         |       |
| Password              | char(41)                          | NO   |     |         |       |
| Select_priv           | enum(N,Y)                     | NO   |     | N       |       |
| Insert_priv           | enum(N,Y)                     | NO   |     | N       |       |
| Update_priv           | enum(N,Y)                     | NO   |     | N       |       |
| Delete_priv           | enum(N,Y)                     | NO   |     | N       |       |
| Create_priv           | enum(N,Y)                     | NO   |     | N       |       |
| Drop_priv             | enum(N,Y)                     | NO   |     | N       |       |
| Reload_priv           | enum(N,Y)                     | NO   |     | N       |       |
| Shutdown_priv         | enum(N,Y)                     | NO   |     | N       |       |
| Process_priv          | enum(N,Y)                     | NO   |     | N       |       |
| File_priv             | enum(N,Y)                     | NO   |     | N       |       |
| Grant_priv            | enum(N,Y)                     | NO   |     | N       |       |
| References_priv       | enum(N,Y)                     | NO   |     | N       |       |
| Index_priv            | enum(N,Y)                     | NO   |     | N       |       |
| Alter_priv            | enum(N,Y)                     | NO   |     | N       |       |
| Show_db_priv          | enum(N,Y)                     | NO   |     | N       |       |
| Super_priv            | enum(N,Y)                     | NO   |     | N       |       |
| Create_tmp_table_priv | enum(N,Y)                     | NO   |     | N       |       |
| Lock_tables_priv      | enum(N,Y)                     | NO   |     | N       |       |
| Execute_priv          | enum(N,Y)                     | NO   |     | N       |       |
| Repl_slave_priv       | enum(N,Y)                     | NO   |     | N       |       |
| Repl_client_priv      | enum(N,Y)                     | NO   |     | N       |       |
| Create_view_priv      | enum(N,Y)                     | NO   |     | N       |       |
| Show_view_priv        | enum(N,Y)                     | NO   |     | N       |       |
| Create_routine_priv   | enum(N,Y)                     | NO   |     | N       |       |
| Alter_routine_priv    | enum(N,Y)                     | NO   |     | N       |       |
| Create_user_priv      | enum(N,Y)                     | NO   |     | N       |       |
| Event_priv            | enum(N,Y)                     | NO   |     | N       |       |
| Trigger_priv          | enum(N,Y)                     | NO   |     | N       |       |
| ssl_type              | enum(‘‘,ANY,X509,SPECIFIED) | NO   |     |         |       |
| ssl_cipher            | blob                              | NO   |     | NULL    |       |
| x509_issuer           | blob                              | NO   |     | NULL    |       |
| x509_subject          | blob                              | NO   |     | NULL    |       |
| max_questions         | int(11) unsigned                  | NO   |     | 0       |       |
| max_updates           | int(11) unsigned                  | NO   |     | 0       |       |
| max_connections       | int(11) unsigned                  | NO   |     | 0       |       |
| max_user_connections  | int(11) unsigned                  | NO   |     | 0       |       |
 ----------------------- ----------------------------------- ------ ----- --------- ------- 
mysql> select User,Password,Host from mysql.user;
 ------------------ ------------------------------------------- --------------- 
| User             | Password                                  | Host          |
 ------------------ ------------------------------------------- --------------- 
| root             | *73316569DAC7839C2A784FF263F5C0ABBC7086E2 | localhost     |
| root             | *D5D9F81F5542DE067FFF5FF7A4CA4BDD322C578F | brokenwebapps |
| root             | *D5D9F81F5542DE067FFF5FF7A4CA4BDD322C578F | 127.0.0.1     |
| debian-sys-maint | *75F15FF5C9F06A7221FEB017724554294E40A327 | localhost     |
| phpmyadmin       | *D5D9F81F5542DE067FFF5FF7A4CA4BDD322C578F | localhost     |
| vicnum           | *C7847100CDBE29050A338F78EA71F066D196ED98 | localhost     |
| wordpress        | *C260A4F79FA905AF65142FFE0B9A14FE0E1519CC | %             |
| phpbb            | *CA1F8B079BB2857835107EA008871B4691769547 | %             |
| dvwa             | *D67B38CDCD1A55623ED5F55856A29B9654FF823D | %             |
| mutillidae       | *E82A07F59B0D83BEF29F79E41FA0F8A042CE3DE4 | %             |
| yazd             | *3758F91540524F48F92FE932883C54F6E802A13A | %             |
| personalblog     | *3D118FD3FFC74F534A493C30ADC1F23A48510D9D | %             |
| yazd10           | *30B462BE16C04867D06113304F664BB9A5B573D8 | %             |
| peruggia         | *5297BE816CC703E8CB686D205071E9CD9E8F08A4 | %             |
| ghost            | *9AE953952D993ED69779E70E28193A1EB8DDF91C | %             |
| gtd-php          | *C238B1FA6D14124C867DC9634DEB2CD731212094 | %             |
| getboo           | *8FC7327502AA1203AAE881C4A5E2AA1CD6E46CE8 | %             |
| orangehrm        | *82183BF1F275E47C2692B1CF81CB7A8FD16CE5EA | %             |
| webcal           | *E2E1F0A3459647AACF63319694BCBD107231B10C | localhost     |
| gallery2         | *DF0F41B82DFDB4AA462186480FA9922EF4BBFCEB | localhost     |
| tikiwiki         | *48529BB639EC6E4C2A6695C4B3D544A9E2A21D4C | localhost     |
| joomla           | *F70658E9BDD2910AC33ACDA164605DFC1DA70A68 | localhost     |
| jotto            | *6126D5A029ACE603DBF187A301C1CCEAEDCFE232 | %             |
| hex              | *E5C4AA1177F0A69A9E124CDC2676D4ECCE01E347 | localhost     |
| webmaster        | *ED2048BBC6AFD6E2186982869C7899A7EF38C066 | localhost     |
| kbloom           | *10A99DBC0772291AA6AF9A1A9271945340E4E812 | localhost     |
| sendmail         | *47A91042510E7E966EF4075A934A77A57A9E71FE | localhost     |
| undertaker       | *02EAFACD13AEC2C2E139EA38903B9A84A165DF0B | localhost     |
| stealth          | *0F44FA14B9DFBBFFBDF2F7692868DE1B997C66ED | localhost     |
| wraith           | *93ADDFABFCD5A66C95E97C73240D373413A01275 | localhost     |
| citizens         | *E0E85D302E82538A1FDA46B453F687F3964A99B4 | localhost     |
| wackopicko       | *5FA5F4C9ACD2CA5C1EB9E0EC80175D5FCAA0D7D6 | %             |
| wavsep           | *8028371417372EDAD5755F9653E93D7C1E87564C | localhost     |
| sqlol            | *1DB6D61428C07B8E8D6876CC60ECAD01D2CE844A | %             |
| cryptomg         | *2132873552FEDF6780E8060F927DD5101759C4DE | %             |
| webgoat.net      | *4BA609A0C9C18D80985519932BAC08C604119234 | %             |
| bricks           | *255195939290DC6D228944BCC682D2427DA57E21 | %             |
| bwapp            | *63C3CE60C4AC4F87F321E54F290A4867684A96C4 | %             |
 ------------------ ------------------------------------------- --------------- 
mysql> desc wordpress.wp_users;
 --------------------- --------------------- ------ ----- --------------------- ---------------- 
| Field               | Type                | Null | Key | Default             | Extra          |
 --------------------- --------------------- ------ ----- --------------------- ---------------- 
| ID                  | bigint(20) unsigned | NO   | PRI | NULL                | auto_increment |
| user_login          | varchar(60)         | NO   | MUL |                     |                |
| user_pass           | varchar(64)         | NO   |     |                     |                |
| user_nicename       | varchar(50)         | NO   |     |                     |                |
| user_email          | varchar(100)        | NO   |     |                     |                |
| user_url            | varchar(100)        | NO   |     |                     |                |
| user_registered     | datetime            | NO   |     | 0000-00-00 00:00:00 |                |
| user_activation_key | varchar(60)         | NO   |     |                     |                |
| user_status         | int(11)             | NO   |     | 0                   |                |
| display_name        | varchar(250)        | NO   |     |                     |                |
 --------------------- --------------------- ------ ----- --------------------- ---------------- 
mysql> select ID,user_login,user_pass from wordpress.wp_users;
 ---- ------------ ---------------------------------- 
| ID | user_login | user_pass                        |
 ---- ------------ ---------------------------------- 
|  1 | admin      | 21232f297a57a5a743894a0e4a801fc3 |
|  2 | user       | ee11cbb19052e40b07aac0ca060c23ee |
 ---- ------------ ---------------------------------- 

条件查询

mysql> select user,password,Host from mysql.user where user="root";
 ------ ------------------------------------------- --------------- 
| user | password                                  | Host          |
 ------ ------------------------------------------- --------------- 
| root | *73316569DAC7839C2A784FF263F5C0ABBC7086E2 | localhost     |
| root | *D5D9F81F5542DE067FFF5FF7A4CA4BDD322C578F | brokenwebapps |
| root | *D5D9F81F5542DE067FFF5FF7A4CA4BDD322C578F | 127.0.0.1     |
 ------ ------------------------------------------- --------------- 
mysql> select user,password,Host from mysql.user where user="root" and Host="localhost";
 ------ ------------------------------------------- ----------- 
| user | password                                  | Host      |
 ------ ------------------------------------------- ----------- 
| root | *73316569DAC7839C2A784FF263F5C0ABBC7086E2 | localhost |
 ------ ------------------------------------------- ----------- 

 

mysql> select user,password,Host from mysql.user where user="root" or Host="localhost";
 ------------------ ------------------------------------------- --------------- 
| user             | password                                  | Host          |
 ------------------ ------------------------------------------- --------------- 
| root             | *73316569DAC7839C2A784FF263F5C0ABBC7086E2 | localhost     |
| root             | *D5D9F81F5542DE067FFF5FF7A4CA4BDD322C578F | brokenwebapps |
| root             | *D5D9F81F5542DE067FFF5FF7A4CA4BDD322C578F | 127.0.0.1     |
| debian-sys-maint | *75F15FF5C9F06A7221FEB017724554294E40A327 | localhost     |
| phpmyadmin       | *D5D9F81F5542DE067FFF5FF7A4CA4BDD322C578F | localhost     |
| vicnum           | *C7847100CDBE29050A338F78EA71F066D196ED98 | localhost     |
| webcal           | *E2E1F0A3459647AACF63319694BCBD107231B10C | localhost     |
| gallery2         | *DF0F41B82DFDB4AA462186480FA9922EF4BBFCEB | localhost     |
| tikiwiki         | *48529BB639EC6E4C2A6695C4B3D544A9E2A21D4C | localhost     |
| joomla           | *F70658E9BDD2910AC33ACDA164605DFC1DA70A68 | localhost     |
| hex              | *E5C4AA1177F0A69A9E124CDC2676D4ECCE01E347 | localhost     |
| webmaster        | *ED2048BBC6AFD6E2186982869C7899A7EF38C066 | localhost     |
| kbloom           | *10A99DBC0772291AA6AF9A1A9271945340E4E812 | localhost     |
| sendmail         | *47A91042510E7E966EF4075A934A77A57A9E71FE | localhost     |
| undertaker       | *02EAFACD13AEC2C2E139EA38903B9A84A165DF0B | localhost     |
| stealth          | *0F44FA14B9DFBBFFBDF2F7692868DE1B997C66ED | localhost     |
| wraith           | *93ADDFABFCD5A66C95E97C73240D373413A01275 | localhost     |
| citizens         | *E0E85D302E82538A1FDA46B453F687F3964A99B4 | localhost     |
| wavsep           | *8028371417372EDAD5755F9653E93D7C1E87564C | localhost     |
 ------------------ ------------------------------------------- --------------- 
mysql> desc dvwa.users;
 ------------ ------------- ------ ----- --------- ------- 
| Field      | Type        | Null | Key | Default | Extra |
 ------------ ------------- ------ ----- --------- ------- 
| user_id    | int(6)      | NO   | PRI | 0       |       |
| first_name | varchar(15) | YES  |     | NULL    |       |
| last_name  | varchar(15) | YES  |     | NULL    |       |
| user       | varchar(15) | YES  |     | NULL    |       |
| password   | varchar(32) | YES  |     | NULL    |       |
| avatar     | varchar(70) | YES  |     | NULL    |       |
 ------------ ------------- ------ ----- --------- ------- 
mysql> select user_id,password from dvwa.users where user="art";
Empty set (0.00 sec)
mysql> select user_id,password from dvwa.users where user="art" and 1=1;
Empty set (0.00 sec)
mysql> select user_id,password from dvwa.users where user="art" or 1=1;
 --------- ---------------------------------- 
| user_id | password                         |
 --------- ---------------------------------- 
|       1 | 21232f297a57a5a743894a0e4a801fc3 |
|       2 | e99a18c428cb38d5f260853678922e03 |
|       3 | 8d3533d75ae2c3966d7e0d4fcc69216b |
|       4 | 0d107d09f5bbe40cade3de5c71e9e9b7 |
|       5 | 5f4dcc3b5aa765d61d8327deb882cf99 |
|       6 | ee11cbb19052e40b07aac0ca060c23ee |
 --------- ---------------------------------- 

联合查询

mysql> select user,password from mysql.user union select user_login,user_pass from wordpress.wp_users;
 ------------------ ------------------------------------------- 
| user             | password                                  |
 ------------------ ------------------------------------------- 
| root             | *73316569DAC7839C2A784FF263F5C0ABBC7086E2 |
| root             | *D5D9F81F5542DE067FFF5FF7A4CA4BDD322C578F |
| debian-sys-maint | *75F15FF5C9F06A7221FEB017724554294E40A327 |
| phpmyadmin       | *D5D9F81F5542DE067FFF5FF7A4CA4BDD322C578F |
| vicnum           | *C7847100CDBE29050A338F78EA71F066D196ED98 |
| wordpress        | *C260A4F79FA905AF65142FFE0B9A14FE0E1519CC |
| phpbb            | *CA1F8B079BB2857835107EA008871B4691769547 |
| dvwa             | *D67B38CDCD1A55623ED5F55856A29B9654FF823D |
| mutillidae       | *E82A07F59B0D83BEF29F79E41FA0F8A042CE3DE4 |
| yazd             | *3758F91540524F48F92FE932883C54F6E802A13A |
| personalblog     | *3D118FD3FFC74F534A493C30ADC1F23A48510D9D |
| yazd10           | *30B462BE16C04867D06113304F664BB9A5B573D8 |
| peruggia         | *5297BE816CC703E8CB686D205071E9CD9E8F08A4 |
| ghost            | *9AE953952D993ED69779E70E28193A1EB8DDF91C |
| gtd-php          | *C238B1FA6D14124C867DC9634DEB2CD731212094 |
| getboo           | *8FC7327502AA1203AAE881C4A5E2AA1CD6E46CE8 |
| orangehrm        | *82183BF1F275E47C2692B1CF81CB7A8FD16CE5EA |
| webcal           | *E2E1F0A3459647AACF63319694BCBD107231B10C |
| gallery2         | *DF0F41B82DFDB4AA462186480FA9922EF4BBFCEB |
| tikiwiki         | *48529BB639EC6E4C2A6695C4B3D544A9E2A21D4C |
| joomla           | *F70658E9BDD2910AC33ACDA164605DFC1DA70A68 |
| jotto            | *6126D5A029ACE603DBF187A301C1CCEAEDCFE232 |
| hex              | *E5C4AA1177F0A69A9E124CDC2676D4ECCE01E347 |
| webmaster        | *ED2048BBC6AFD6E2186982869C7899A7EF38C066 |
| kbloom           | *10A99DBC0772291AA6AF9A1A9271945340E4E812 |
| sendmail         | *47A91042510E7E966EF4075A934A77A57A9E71FE |
| undertaker       | *02EAFACD13AEC2C2E139EA38903B9A84A165DF0B |
| stealth          | *0F44FA14B9DFBBFFBDF2F7692868DE1B997C66ED |
| wraith           | *93ADDFABFCD5A66C95E97C73240D373413A01275 |
| citizens         | *E0E85D302E82538A1FDA46B453F687F3964A99B4 |
| wackopicko       | *5FA5F4C9ACD2CA5C1EB9E0EC80175D5FCAA0D7D6 |
| wavsep           | *8028371417372EDAD5755F9653E93D7C1E87564C |
| sqlol            | *1DB6D61428C07B8E8D6876CC60ECAD01D2CE844A |
| cryptomg         | *2132873552FEDF6780E8060F927DD5101759C4DE |
| webgoat.net      | *4BA609A0C9C18D80985519932BAC08C604119234 |
| bricks           | *255195939290DC6D228944BCC682D2427DA57E21 |
| bwapp            | *63C3CE60C4AC4F87F321E54F290A4867684A96C4 |
| admin            | 21232f297a57a5a743894a0e4a801fc3          |
| user             | ee11cbb19052e40b07aac0ca060c23ee          |
 ------------------ ------------------------------------------- 
39 rows in set (0.11 sec)

union查询的前后字段必须相同,不足时可以用数字来代替;

mysql> select user,password from mysql.user union select user_login,user_pass from wordpress.wp_users limit 5;
 ------------------ ------------------------------------------- 
| user             | password                                  |
 ------------------ ------------------------------------------- 
| root             | *73316569DAC7839C2A784FF263F5C0ABBC7086E2 |
| root             | *D5D9F81F5542DE067FFF5FF7A4CA4BDD322C578F |
| debian-sys-maint | *75F15FF5C9F06A7221FEB017724554294E40A327 |
| phpmyadmin       | *D5D9F81F5542DE067FFF5FF7A4CA4BDD322C578F |
| vicnum           | *C7847100CDBE29050A338F78EA71F066D196ED98 |
 ------------------ ------------------------------------------- 
5 rows in set (0.00 sec)
mysql> select user,password from mysql.user where 1=2 union select user_login,user_pass from wordpress.wp_users limit 5;
 ------- ---------------------------------- 
| user  | password                         |
 ------- ---------------------------------- 
| admin | 21232f297a57a5a743894a0e4a801fc3 |
| user  | ee11cbb19052e40b07aac0ca060c23ee |
 ------- ---------------------------------- 

猜字段

mysql> select * from dvwa.users  union select 1;
ERROR 1222 (21000): The used SELECT statements have a different number of columns
mysql> select * from dvwa.users  union select 1,2;
ERROR 1222 (21000): The used SELECT statements have a different number of columns
mysql> select * from dvwa.users  union select 1,2,3;
ERROR 1222 (21000): The used SELECT statements have a different number of columns
mysql> select * from dvwa.users  union select 1,2,3,4;
ERROR 1222 (21000): The used SELECT statements have a different number of columns
mysql> select * from dvwa.users  union select 1,2,3,4,5;
ERROR 1222 (21000): The used SELECT statements have a different number of columns
mysql> select * from dvwa.users  union select 1,2,3,4,5,6;
 --------- ------------ ----------- --------- ---------------------------------- -------------------------------------------------- 
| user_id | first_name | last_name | user    | password                         | avatar                                           |
 --------- ------------ ----------- --------- ---------------------------------- -------------------------------------------------- 
|       1 | admin      | admin     | admin   | 21232f297a57a5a743894a0e4a801fc3 | http://127.0.0.1/dvwa/hackable/users/admin.jpg   |
|       2 | Gordon     | Brown     | gordonb | e99a18c428cb38d5f260853678922e03 | http://127.0.0.1/dvwa/hackable/users/gordonb.jpg |
|       3 | Hack       | Me        | 1337    | 8d3533d75ae2c3966d7e0d4fcc69216b | http://127.0.0.1/dvwa/hackable/users/1337.jpg    |
|       4 | Pablo      | Picasso   | pablo   | 0d107d09f5bbe40cade3de5c71e9e9b7 | http://127.0.0.1/dvwa/hackable/users/pablo.jpg   |
|       5 | Bob        | Smith     | smithy  | 5f4dcc3b5aa765d61d8327deb882cf99 | http://127.0.0.1/dvwa/hackable/users/smithy.jpg  |
|       6 | user       | user      | user    | ee11cbb19052e40b07aac0ca060c23ee | http://127.0.0.1/dvwa/hackable/users/1337.jpg    |
|       1 | 2          | 3         | 4       | 5                                | 6                                                |
 --------- ------------ ----------- --------- ---------------------------------- -------------------------------------------------- 
7 rows in set (0.00 sec)
mysql> select * from dvwa.users where 1=2 union select user_login,user_pass,3,4,5,6 from wordpress.wp_users;
 --------- ---------------------------------- ----------- ------ ---------- -------- 
| user_id | first_name                       | last_name | user | password | avatar |
 --------- ---------------------------------- ----------- ------ ---------- -------- 
| admin   | 21232f297a57a5a743894a0e4a801fc3 | 3         | 4    | 5        | 6      |
| user    | ee11cbb19052e40b07aac0ca060c23ee | 3         | 4    | 5        | 6      |
 --------- ---------------------------------- ----------- ------ ---------- -------- 

 

 

information_schema

 --------------------------------------- 
| Tables_in_information_schema          |
 --------------------------------------- 
| CHARACTER_SETS                        |
| COLLATIONS                            |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS                               |
| COLUMN_PRIVILEGES                     |
| ENGINES                               |
| EVENTS                                |
| FILES                                 |
| GLOBAL_STATUS                         |
| GLOBAL_VARIABLES                      |
| KEY_COLUMN_USAGE                      |
| PARTITIONS                            |
| PLUGINS                               |
| PROCESSLIST                           |
| PROFILING                             |
| REFERENTIAL_CONSTRAINTS               |
| ROUTINES                              |
| SCHEMATA                              |
| SCHEMA_PRIVILEGES                     |
| SESSION_STATUS                        |
| SESSION_VARIABLES                     |
| STATISTICS                            |
| TABLES                                |
| TABLE_CONSTRAINTS                     |
| TABLE_PRIVILEGES                      |
| TRIGGERS                              |
| USER_PRIVILEGES                       |
| VIEWS                                 |
 --------------------------------------- 

查看内存和负载信息

free
root@owaspbwa:~# uptime 07:21:00 up 3:57, 2 users, load average: 0.00, 0.00, 0.00

卸载

a:~# umount /proc -l    不管忙不忙,只管卸载
root@owaspbwa:~# free
Cannot find /proc/version - is /proc mounted?

mount proc -t proc /proc

 

查询数据库名,表名         information_schema.tables

*************************** 638. row ***************************
  TABLE_CATALOG: NULL
   TABLE_SCHEMA: webcal
     TABLE_NAME: webcal_view
     TABLE_TYPE: BASE TABLE
         ENGINE: MyISAM
        VERSION: 10
     ROW_FORMAT: Dynamic
     TABLE_ROWS: 0
 AVG_ROW_LENGTH: 0
    DATA_LENGTH: 0
MAX_DATA_LENGTH: 281474976710655
   INDEX_LENGTH: 1024
      DATA_FREE: 0
 AUTO_INCREMENT: NULL
    CREATE_TIME: 2011-04-17 13:11:41
    UPDATE_TIME: 2011-04-17 13:11:41
     CHECK_TIME: NULL
TABLE_COLLATION: latin1_swedish_ci
       CHECKSUM: NULL
 CREATE_OPTIONS: 
  TABLE_COMMENT: 

上面是information_schema.TABLES表的部分内容,记录了表的一些信息;

mysql> select DISTINCT TABLE_SCHEMA from TABLES;  相当于show databases;
 -------------------- 
| TABLE_SCHEMA       |
 -------------------- 
| information_schema |
| bricks             |
| bwapp              |
| citizens           |
| cryptomg           |
| dvwa               |
| gallery2           |
| getboo             |
| ghost              |
| gtd-php            |
| hex                |
| isp                |
| joomla             |
| mutillidae         |
| mysql              |
| nowasp             |
| orangehrm          |
| personalblog       |
| peruggia           |
| phpbb              |
| phpmyadmin         |
| proxy              |
| rentnet            |
| sqlol              |
| tikiwiki           |
| vicnum             |
| wackopicko         |
| wavsepdb           |
| webcal             |
| webgoat_coins      |
| wordpress          |
| wraithlogin        |
| yazd               |
 -------------------- 
mysql> select TABLE_SCHEMA,TABLE_NAME from TABLES limit 5;
 -------------------- --------------------------------------- 
| TABLE_SCHEMA       | TABLE_NAME                            |
 -------------------- --------------------------------------- 
| information_schema | CHARACTER_SETS                        |
| information_schema | COLLATIONS                            |
| information_schema | COLLATION_CHARACTER_SET_APPLICABILITY |
| information_schema | COLUMNS                               |
| information_schema | COLUMN_PRIVILEGES                     |
 -------------------- --------------------------------------- 
mysql> select TABLE_SCHEMA,GROUP_CONCAT(TABLE_NAME) from TABLES group by TABLE_SCHEMA G  ; 
*************************** 1. row ***************************
            TABLE_SCHEMA: bricks
GROUP_CONCAT(TABLE_NAME): users
*************************** 2. row ***************************
            TABLE_SCHEMA: bwapp
GROUP_CONCAT(TABLE_NAME): blog,users,movies,heroes
mysql> select TABLE_NAME from TABLES where TABLE_SCHEMA=dvwa;
 ------------ 
| TABLE_NAME |
 ------------ 
| guestbook  |
| users      |
 ------------ 

 

 

查询数据库名,表名,字段名   information_schema.columns

************************** 4682. row ***************************
           TABLE_CATALOG: NULL
            TABLE_SCHEMA: yazd                    库名
              TABLE_NAME: yazduserprop            表名
             COLUMN_NAME: propValue         字段名
        ORDINAL_POSITION: 3
          COLUMN_DEFAULT: NULL
             IS_NULLABLE: NO
               DATA_TYPE: varchar
CHARACTER_MAXIMUM_LENGTH: 255
  CHARACTER_OCTET_LENGTH: 255
       NUMERIC_PRECISION: NULL
           NUMERIC_SCALE: NULL
      CHARACTER_SET_NAME: latin1
          COLLATION_NAME: latin1_swedish_ci
             COLUMN_TYPE: varchar(255)
              COLUMN_KEY: 
                   EXTRA: 
              PRIVILEGES: select,insert,update,references
          COLUMN_COMMENT: 
mysql> select COLUMN_NAME from information_schema.columns G; 查询所有的字段名
mysql> select COLUMN_NAME from information_schema.columns where table_schema="yazd" and table_name="yazduserprop";
 ------------- 
| COLUMN_NAME |
 ------------- 
| userID      |
| name        |
| propValue   |
 ------------- 

 

?