Mysql

sql注入“睡眠”

  • April 19, 2020

如何確定 ip 地址或 url 地址日誌？我的 mysql-slow-query 中有這個

   /usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
# Time: 200419 11:12:39
# User@Host: root[root] @ localhost []
# Query_time: 51.904912  Lock_time: 0.000103 Rows_sent: 0  Rows_examined: 0
use lastfiles;
SET timestamp=1587287559;
SELECT id,name,descr,filename,size,category,seeders,leechers,added FROM torrents WHERE category IN (25 AnD SlEeP(3000)) AND visible='yes' ORDER BY added DESC LIMIT 15;
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
# Time: 200419 11:43:06
# User@Host: root[root] @ localhost []
# Query_time: 973.189006  Lock_time: 0.000097 Rows_sent: 0  Rows_examined: 0
use lastfiles;
SET timestamp=1587289386;
SELECT id,name,descr,filename,size,category,seeders,leechers,added FROM torrents WHERE category IN (25 AnD SlEeP(3000)) AND visible='yes' ORDER BY added DESC LIMIT 15;
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
# Time: 200419 11:59:27
# User@Host: root[root] @ localhost []
# Query_time: 144.803710  Lock_time: 0.000022 Rows_sent: 0  Rows_examined: 0
use lastfiles;
SET timestamp=1587290367;
SELECT id,name,descr,filename,size,category,seeders,leechers,added FROM torrents WHERE category IN (25 AnD SlEeP(3000)) AND visible='yes' ORDER BY added DESC LIMIT 15;
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
# Time: 200419 12:21:58
# User@Host: nutecredinstare[nutecredinstare] @ localhost []
# Query_time: 590.385342  Lock_time: 0.000102 Rows_sent: 0  Rows_examined: 0
use lastfiles;
SET timestamp=1587291718;
SELECT id,name,descr,filename,size,category,seeders,leechers,added FROM torrents WHERE category IN (25 AnD SlEeP(3000)) AND visible='yes' ORDER BY added DESC LIMIT 15;
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
# Time: 200419 12:27:31
# User@Host: nutecredinstare[nutecredinstare] @ localhost []
# Query_time: 18.139393  Lock_time: 0.000039 Rows_sent: 0  Rows_examined: 0
use lastfiles;
SET timestamp=1587292051;
SELECT id,name,descr,filename,size,category,seeders,leechers,added FROM torrents WHERE category IN (25 AnD SlEeP(3000)) AND visible='yes' ORDER BY added DESC LIMIT 15;
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
# Time: 200419 12:51:08
# User@Host: nutecredinstare[nutecredinstare] @ localhost []
# Query_time: 530.583547  Lock_time: 0.000022 Rows_sent: 0  Rows_examined: 0
use lastfiles;
SET timestamp=1587293468;
SELECT id,name,descr,filename,size,category,seeders,leechers,added FROM torrents WHERE category IN (25 AnD SlEeP(3000)) AND visible='yes' ORDER BY added DESC LIMIT 15;
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
# Time: 200419 12:58:07
# User@Host: nutecredinstare[nutecredinstare] @ localhost []
# Query_time: 43.678108  Lock_time: 0.000078 Rows_sent: 0  Rows_examined: 0
use lastfiles;
SET timestamp=1587293887;
SELECT id,name,descr,filename,size,category,seeders,leechers,added FROM torrents WHERE category IN (25 AnD SlEeP(3000)) AND visible='yes' ORDER BY added DESC LIMIT 15;
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
# Time: 200419 13:13:41
# User@Host: nutecredinstare[nutecredinstare] @ localhost []
# Query_time: 72.950484  Lock_time: 0.000083 Rows_sent: 0  Rows_examined: 0
use lastfiles;
SET timestamp=1587294821;
SELECT id,name,descr,filename,size,category,seeders,leechers,added FROM torrents WHERE category IN (25 AnD SlEeP(3000)) AND visible='yes' ORDER BY added DESC LIMIT 15;
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
# Time: 200419 13:26:14
# User@Host: nutecredinstare[nutecredinstare] @ localhost []
# Query_time: 45.907777  Lock_time: 0.000025 Rows_sent: 0  Rows_examined: 0
use lastfiles;
SET timestamp=1587295574;
SELECT id,name,descr,filename,size,category,seeders,leechers,added FROM torrents WHERE category IN (25 AnD SlEeP(3000)) AND visible='yes' ORDER BY added DESC LIMIT 15;
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
# Time: 200419 13:48:59
# User@Host: nutecredinstare[nutecredinstare] @ localhost []
# Query_time: 1106.049268  Lock_time: 0.000077 Rows_sent: 0  Rows_examined: 0
use lastfiles;
SET timestamp=1587296939;
SELECT id,name,descr,filename,size,category,seeders,leechers,added FROM torrents WHERE category IN (25 AnD SlEeP(3000)) AND visible='yes' ORDER BY added DESC LIMIT 15;
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
# Time: 200419 13:56:32
# User@Host: nutecredinstare[nutecredinstare] @ localhost []
# Query_time: 338.521235  Lock_time: 0.000076 Rows_sent: 0  Rows_examined: 0
use lastfiles;
SET timestamp=1587297392;
SELECT id,name,descr,filename,size,category,seeders,leechers,added FROM torrents WHERE category IN (25 AnD SlEeP(3000)) AND visible='yes' ORDER BY added DESC LIMIT 15;
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
# Time: 200419 14:06:26
# User@Host: nutecredinstare[nutecredinstare] @ localhost []
# Query_time: 321.585240  Lock_time: 0.000103 Rows_sent: 0  Rows_examined: 0
use lastfiles;
SET timestamp=1587297986;
SELECT id,name,descr,filename,size,category,seeders,leechers,added FROM torrents WHERE category IN (25 AnD SlEeP(3000)) AND visible='yes' ORDER BY added DESC LIMIT 15;
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
# Time: 200419 14:12:51
# User@Host: nutecredinstare[nutecredinstare] @ localhost []
# Query_time: 83.491684  Lock_time: 0.000038 Rows_sent: 0  Rows_examined: 0
use lastfiles;
SET timestamp=1587298371;
SELECT id,name,descr,filename,size,category,seeders,leechers,added FROM torrents WHERE category IN (25 AnD SlEeP(3000)) AND visible='yes' ORDER BY added DESC LIMIT 15;
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument
/usr/sbin/mysqld, Version: 5.5.62-0ubuntu0.14.04.1-log ((Ubuntu)). started with:
Tcp port: 3306  Unix socket: /var/run/mysqld/mysqld.sock
Time                 Id Command    Argument

找到你的<form>.

找到您“插入”的位置以建構 id 列表。

黑客對你很好——他表明你的漏洞是一種相對無害的方式。

他可能正在建構一個從表單提供“id”的 URL，但它說

... &id=25+AnD+SlEeP(3000) ...

那你在做

$query = "SELECT ... " + $_GET['id'] + ...

而不是轉義或綁定。

引用自：https://serverfault.com/questions/1013033

相關問答

Mysql

防止 SQL 注入的動態列列舉

  • June 27, 2016
檢視問答
Mysql

如何將mysql查詢連結到php程序？

  • February 3, 2013
檢視問答
Php

將 MySQL 數據庫移動到另一台伺服器

  • March 8, 2012
檢視問答
Php

無法登錄到 phpMyAdmin

  • December 18, 2011
檢視問答
Mysql

使用非 MySQL 後端執行 indexhibit —— 可以嗎？

  • September 3, 2011
檢視問答
Mysql

如何在php中重命名mysql表？

  • August 5, 2011
檢視問答