SQL Injection Bypass Method collection

one.%0 0 truncation

%00 truncation is a very classic gesture commonly used in upload vulnerabilities, and can be used to bypass SQL injection. In the WAF layer, after receiving the parameter ID, encounter%00 truncation, only get to id=1, unable to get to the back of the harmful parameter input;

　　

http://host/sql.aspx?id=1%00and 1=2 Union select 1,2,column_name from Information_schema.columns

Two. Get+post

When a GET, POST request is submitted at the same time, the post logic is entered, and the bad parameter input of the GET request is ignored, which can be easily bypass. Applicable in Iis+asp/aspx+mssql Iis+php+mysql.

Three. Unicode encoding

The IIS server supports parsing of Unicode, and Unicode encoding of the keywords is bypassed.

Four: ASPX+HPP

in aspx, there is a special HPP feature that when Get/post/cookie submits the parameter ID at the same time, the server receives the parameter ID in the order Get,post,cookie, in the middle by a comma link. the UNION, SELECT, and two keyword splits are placed in the get/post position, linked by this feature of ASPX.

V: ASP% features

　　In iis+asp, when we enter the Un%ion, the resolution will remove the% number, and the parameters received by the server are union

Six: Buffer overflow

In Php+mysql, the idea of using post packet overflow is successful.

　　

http://host/sql.phppost:id=1 and (select 1) = (select 0xa*49099) union select 1,schema_name, 3 from INFORMATION_SCHEMA. Schemata

SQL Injection Bypass Method collection