MySQL Injection general idea

1. and 1=1 and 1=2 judgment

2. Whether to support the order by burst display bit

3. Display bit to check important information, user (), version (), database (), Construct syntax query table

4. According to the above information to see if the authority is root mysql5.0 above, that is, read and write permissions

5. If Root wants to read and write, it needs 1, absolute path 2, can read and write (because there are two switches, related to whether can read and write)

6. How to find the absolute path: 1. Error display 2. Google hack search site: URL keyword (warning error background management-in the background can have paths, etc.)

3. Scanning software Scan Directory Royal Sword Pangolin radish and so on. Vulnerability scanning: Netsparker/acunetix Web

4. After the URL or different directory, tempted to manually access key files such as: php.php phpinfo.php info.php, etc.

7. Side note

MySQL Injection general idea