i 春秋月刊 4：SQL 注入 (it-ebooks)（Z-Library）

【One-Line Pitch】 A compact, hands-on Chinese security zine issue that walks readers from SQL injection fundamentals to real-world tooling and framework-specific exploits. Best for beginners and junior pentesters who want a practical, example-driven path into web database attacks rather than a formal textbook. 【Book Arc】 - **Opening (~0%–11%)**: The issue opens with a table of contents and a three-tier structure (beginner/intermediate/advanced), then teaches SQL basics, how injection arises from dynamically built query strings, and how to deliberately write a vulnerable PHP/MySQL page as a lab target. - **Early (~11%–32%)**: Moves into finding and confirming injection points — error-based inference, the "and/or" truth tests, arithmetic checks for numeric vs. string parameters — then escalates to exploitation: fingerprinting the DBMS, using UNION to extract data, enumerating schemas/tables/columns, stealing password hashes, and writing a WebShell. - **Early–Middle (~26%–37%)**: Introduces blind injection (boolean-based and time-based), automating extraction with a Python script, and then advanced evasion — case variation, URL encoding, SQL comments, null bytes, and second-order injection — closing with defensive countermeasures like input validation and parameterized queries. - **Middle (~37%–53%)**: Shifts to tooling. A Burp Suite proxy walkthrough shows how to intercept and read the injection statements that tools like Pangolin and sqlmap generate, followed by DNS exfiltration injection and an automated sqlmap DNS option. - **Middle (~53%–58%)**: A catalog of common sqlmap workflows — database/table/column dumping, POST login-form injection via Burp-saved requests, Google dorking, request delays, WAF bypass with tamper scripts, privilege checks, pseudo-static injection, and OS command/shell execution. - **Late (~58%–end)**: The practical section applies everything to real targets: ThinkPHP 3.2.x and ThinkPHP <5.0.16 SQL injection vulnerability analyses, plus a second installment on wide-byte injection. 【Key Takeaways】 - **Injection is a logic problem, not a syntax trick** (Opening): The root cause is concatenating user input into dynamic SQL; understanding this lets you both build and spot vulnerable code. - **Confirmation comes before exploitation** (Early): Error messages, and/or truth tests, and arithmetic probes reliably distinguish injectable numeric and string parameters. - **UNION and metadata tables are the extraction engine** (Early): Matching column counts and querying `information_schema` turn a confirmed flaw into a full database dump. - **Blind injection trades speed for silence** (Early–Middle): Boolean and time-based techniques, plus Python automation, extract data even when no errors or output are returned. - **Filters are bypassable** (Middle): Case variation, encoding, comments, null bytes, and second-order injection show why blacklist filtering alone fails. - **Defense is layered** (Middle): Parameterized queries, whitelist validation, output encoding, least privilege, and disabled dangerous functions form the recommended countermeasures. - **Tooling fluency multiplies skill** (Middle): Proxying sqlmap/Pangolin through Burp reveals the actual payloads, turning opaque tools into learning aids. - **Framework-specific bugs are the real battlefield** (Late): ThinkPHP version-specific injection flaws and wide-byte injection show how generic knowledge maps to concrete CVEs. 【Reading Tips】 - Deep-read the Opening and Early sections if you are new; the hand-built vulnerable lab and confirmation techniques are the foundation everything else builds on. - Skim the sqlmap command catalog (Middle) on first pass, then return to it as a reference when you actually run the tool. - Treat the ThinkPHP and wide-byte chapters (Late) as case studies — read them after you understand UNION and blind techniques, not before. - Reproduce the lab environment locally; this issue is written for practice, and the value comes from running the payloads, not just reading them. - Note the defense section carefully — it is brief but frames the whole issue as offense-in-service-of-defense. 【Coverage Limits】 This guide is synthesized from stratified excerpts of a single zine issue; the excerpts do not cover the full text of every chapter, and some tool command details are only partially shown. No independent verification of the described vulnerabilities or version claims was possible from the excerpts alone.