• Welcome to the world's largest Chinese hacker forum

    Welcome to the world's largest Chinese hacker forum, our forum registration is open! You can now register for technical communication with us, this is a free and open to the world of the BBS, we founded the purpose for the study of network security, please don't release business of black/grey, or on the BBS posts, to seek help hacker if violations, we will permanently frozen your IP and account, thank you for your cooperation. Hacker attack and defense cracking or network Security

    business please click here: Creation Security  From CNHACKTEAM

MySQL注入流程


JieGe

Recommended Posts

  • Members

写个MySQL注入流程的大纲,类似一份全局地图,能指导下一步工作。MySQL注入流程分为四步:

  • 确认注入点
  • 信息收集
  • 数据获取
  • 提权

确认注入点

参考:https://www.cnblogs.com/mysticbinary/p/14401295.html

信息收集

  • 确认数据库类型
    • 这一步主要在确认注入点的时候就已完成,不然也不能确认注入点的存在
    • 主要是通过各个数据库之间的语法差异来确认
  • 查看数据库版本
    • select version();
    • select @@version;
  • 查看数据库全部用户
    • SELECT USER();
  • 查看数据库当前操作用户
    • SELECT CURRENT_USER();
  • 查看数据库用户权限

数据获取

  • 获取库信息
  • 获取表信息
  • 获取列信息
  • 获取数据

提权

  • 执行命令
    • 执行SQL语句
    • 执行系统命令
  • 读文件
    • 读系统信息、配置文件
    • 读中间件、服务配置文件
    • 读数据库配置文件
  • 写文件
    • 写SHELL文件到网站目录
 
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now