one.%0 0 truncation
%00 truncation is a very classic gesture commonly used in upload vulnerabilities, and can be used to bypass SQL injection. In the WAF layer, after receiving the parameter ID, encounter%00 truncation, only get to id=1, unable to get to the back of the harmful parameter input;
http://host/sql.aspx?id=1%00and 1=2 Union select 1,2,column_name from Information_schema.columns
Two. Get+post
When a GET, POST request is submitted at the same time, the post logic is entered, and the bad parameter input of the GET request is ignored, which can be easily bypass. Applicable in Iis+asp/aspx+mssql Iis+php+mysql.
Three. Unicode encoding
The IIS server supports parsing of Unicode, and Unicode encoding of the keywords is bypassed.
Four: ASPX+HPP
in aspx, there is a special HPP feature that when Get/post/cookie submits the parameter ID at the same time, the server receives the parameter ID in the order Get,post,cookie, in the middle by a comma link. the UNION, SELECT, and two keyword splits are placed in the get/post position, linked by this feature of ASPX.
V: ASP% features
In iis+asp, when we enter the Un%ion, the resolution will remove the% number, and the parameters received by the server are union
Six: Buffer overflow
In Php+mysql, the idea of using post packet overflow is successful.
http://host/sql.phppost:id=1 and (select 1) = (select 0xa*49099) union select 1,schema_name, 3 from INFORMATION_SCHEMA. Schemata
SQL Injection Bypass Method collection