Php injection 3. III. some injection techniques, many of which are discovered by individuals. 1. unionselect is used to combine the results of multiple SELECT statements into one result set. Select_exp 3 in SELECT: some injection techniques, many of which are personal discoveries.
1. skills in union select
UNION is used to combine the results of multiple SELECT statements into one result set. Columns listed in the select_expression section of SELECT must be of the same type. The column name used in the first SELECT query is returned as the name of the result set column.
However, we can use the following method to guess the column type, which saves a lot of time.
First
Http: // localhost/down/index. php? Url = & dlid = 1% 20and % 201 = 2% 20 union % 20 select %
4
Let's look at 3 in the software description, and 4 in the Author. we can guess that 3 and 4 are in character type. let's look at the number of downloads before 14, this should be int type, right.
Well, let's build it here. it is estimated that username and password are also character-type.
Try it.
Http: // localhost/down/index. php? Url = & dlid = 1% 20and % 201 = 2% 20 union % 20 select % ,,2, password, 4, username, 6, 7, 8, 9, 10, 11, 12, 13, 16, 17, 18% 20 from % 20dl_users
25
Haha, you just need to look at this method and you can probably guess it.
2. load_file file reading and writing skills
I wonder if you have found that php files cannot be displayed on the webpage when we use load_file () to read and write php files. For example:
C:/apache/htdocs/site/lib/SQL. inc. php is converted to hexadecimal: bytes
The structure is as follows:
Http: // localhost/site/display. php? Id =
451% 20and % 201 = 2% 20% 20 union % 20 select %, load_file (bytes)
26
I found that SQL. inc. php should be displayed in the content of the article, but it is empty. why?
Let's look at the source code of the web page first
7
Haha, look at the Mark. it's dizzy. it's here, but why?
In the original html, <> used for tagging. haha, see! Remember where to find it next time.
Except 1. The union select technique UNION is used to combine the results of multiple SELECT statements into one result set. Select_exp...
