一道CTF題引發的思考-MySQL的幾個特性(續)
0x00 背景
這兩天處於轉牛角尖的狀態，非常不好。但是上一篇的中提到的問題總算是總結了些東西。
傳送門：疑問點0x02(4)
0x01 測試過程
（1）測試環境情況：創建了如下測試表test，
mysql> select * from test;
+---------+-------+-----------------------------------------+
| user_id | user | password |
+---------+-------+-----------------------------------------+
| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99 |
| 2 | ADMIN | 5f4dcc3b5aa765d61d8327deb882cf99 |
+---------+-------+-----------------------------------------+
2 rows in set
（2）測試過程要點：主要測試MySQL的大小寫是否是強匹配，在哪些情況下是強匹配，以及如何使MySQL對大小寫進行強匹配
- 在沒有選擇表的情況下測試，發現不進行編碼(這裏說的編碼是使用char或16進制進行編碼) 時大小寫不是強匹配的。
mysql> select ‘AbC‘ like ‘a%‘;
+-----------------+
| ‘AbC‘ like ‘a%‘ |
+-----------------+
| 1 |
+-----------------+
1 row in set
mysql> select ‘AbC‘ like ‘A%‘;
+-----------------+
| ‘AbC‘ like ‘A%‘ |
+-----------------+
| 1 |
+-----------------+
1 row in set
- 在沒有選擇表的情況下，使用char或者16進制進行編碼後 大小寫是強匹配的
mysql> select ‘AbC‘ like char(97,37); #小a
+------------------------+
| ‘AbC‘ like char(97,37) |
+------------------------+
| 0 |
+------------------------+
1 row in set
mysql> select ‘AbC‘ like char(65,37); #大A
+------------------------+
| ‘AbC‘ like char(65,37)|
+------------------------+
| 1 |
+------------------------+
1 row in set
mysql> select ‘AbC‘ like 0x6125; #小a
+-------------------+
| ‘AbC‘ like 0x6125 |
+-------------------+
| 0 |
+-------------------+
1 row in set
mysql> select ‘AbC‘ like 0x4125; #大A
+-------------------+
| ‘AbC‘ like 0x4125 |
+-------------------+
| 1 |
+-------------------+
1 row in set
- 在沒有選擇表的情況下，可以使用binary對大小寫進行強匹配，當然也可以使用hex,這個在http://www.cnblogs.com/Z3roTo0ne/p/6883132.html已經有說過了，本文就不再說明了。
mysql> select ‘AbC‘ like binary ‘a%‘;
+------------------------+
| ‘AbC‘ like binary ‘a%‘ |
+------------------------+
| 0 |
+------------------------+
1 row in set
mysql> select ‘AbC‘ like binary ‘A%‘;
+------------------------+
| ‘AbC‘ like binary ‘A%‘ |
+------------------------+
| 1 |
+------------------------+
1 row in set
以下是使用正則regexp的方式，與like相似這裏就不啰嗦了。
- 在沒有選擇表的情況下測試，發現不進行編碼，大小寫不是強匹配
mysql> select ‘AbC‘ regexp ‘^a‘;
+-------------------+
| ‘AbC‘ regexp ‘^a‘ |
+-------------------+
| 1 |
+-------------------+
1 row in set
mysql> select ‘AbC‘ regexp ‘^A‘;
+-------------------+
| ‘AbC‘ regexp ‘^A‘ |
+-------------------+
| 1 |
+-------------------+
1 row in set
- 在沒有選擇表的情況下測試，發現進行編碼後，大小寫是強匹配
mysql> select ‘AbC‘ regexp char(94,97);#小a
+--------------------------+
| ‘AbC‘ regexp char(94,97) |
+--------------------------+
| 0 |
+--------------------------+
1 row in set
mysql> select ‘AbC‘ regexp char(94,65);#大A
+--------------------------+
| ‘AbC‘ regexp char(94,65) |
+--------------------------+
| 1 |
+--------------------------+
1 row in set
mysql> select ‘AbC‘ regexp 0x5E61;#小a
+---------------------+
| ‘AbC‘ regexp 0x5E61 |
+---------------------+
| 0 |
+---------------------+
1 row in set
mysql> select ‘AbC‘ regexp 0x5E41;#大A
+---------------------+
| ‘AbC‘ regexp 0x5E41 |
+---------------------+
| 1 |
+---------------------+
1 row in set
- 在沒有選擇表的情況下，可以使用binary對大小寫進行強匹配
mysql> select ‘AbC‘ regexp binary ‘^a‘;
+--------------------------+
| ‘AbC‘ regexp binary ‘^a‘ |
+--------------------------+
| 0 |
+--------------------------+
1 row in set
mysql> select ‘AbC‘ regexp binary ‘^A‘;
+--------------------------+
| ‘AbC‘ regexp binary ‘^A‘ |
+--------------------------+
| 1 |
+--------------------------+
在選擇表或者是通過數據庫函數如user(),database()等獲取數據的測試情況：
- 在查詢表中字段數據時，無論是否進行編碼 ，大小寫都是不強匹配
mysql> select * from test where user like ‘A%‘;
+---------+-------+---------------------------------------+
| user_id | user | password |
+---------+-------+---------------------------------------+
| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99|
| 2 | ADMIN| 5f4dcc3b5aa765d61d8327deb882cf99|
+---------+-------+---------------------------------------+
2 rows in set
mysql> select * from test where user like char(65,37) ;
+---------+-------+---------------------------------------+
| user_id | user | password |
+---------+-------+---------------------------------------+
| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99|
| 2 | ADMIN| 5f4dcc3b5aa765d61d8327deb882cf99|
+---------+-------+---------------------------------------+
2 rows in set
mysql> select * from test where user regexp ‘^A‘;
+---------+-------+---------------------------------------+
| user_id | user | password |
+---------+-------+---------------------------------------+
| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99|
| 2 | ADMIN| 5f4dcc3b5aa765d61d8327deb882cf99|
+---------+-------+---------------------------------------+
2 rows in set
mysql> select * from test where user regexp 0x5E61;
+---------+-------+---------------------------------------+
| user_id | user | password |
+---------+-------+---------------------------------------+
| 1 | admin | 5f4dcc3b5aa765d61d8327deb882cf99|
| 2 | ADMIN| 5f4dcc3b5aa765d61d8327deb882cf99|
+---------+-------+---------------------------------------+
2 rows in set
mysql> select * from test where user regexp binary 0x5E41;
+---------+-------+----------------------------------------------+
| user_id | user | password |
+---------+-------+----------------------------------------------+
| 2 | ADMIN | 5f4dcc3b5aa765d61d8327deb882cf99 |
+---------+-------+----------------------------------------------+
1 row in set
0x02 測試結論
MYSQL大小寫不進行強匹配的。要想匹配大小寫可以使用binary，或者使用http://www.cnblogs.com/Z3roTo0ne/p/6883132.html中的兩次16進制編碼的方式。進行大小寫強匹配。
0x03 另外的一種方式
使用10進制和16進制混合也可以達到區分大小寫的效果，因為大小寫的16進制是不一樣的。
mysql> select conv(hex(substr((user()),1,8)),16,10);
+---------------------------------------+
| conv(hex(substr((user()),1,8)),16,10) |
+---------------------------------------+
| 8245931987826405219 |
+---------------------------------------+
1 row in set
mysql> select unhex(conv((8245931987826405219),10,16));
+----------------------------------------------------+
| unhex(conv((8245931987826405219),10,16)) |
+----------------------------------------------------+
| [email protected] |
+----------------------------------------------------+
1 row in set
一道CTF題引發的思考-MySQL的幾個特性(續)