返回信息流虽然服务器的php配置中大多数是不显示error的(国内主机不清楚),
此文还是有一定的实际意义。
仅管我判断列个数时好像从没有超过5分钟,hoho~~~~
Some SQL Injection Research.
Posted on 19 06 07 - permalink
Next week I'm going to do some more research on SQL injection. I have a pretty complete sheet for MySQL but I thought about more ways of information gathering. One of them is pretty slick if I may say myself. Usually when you do a UNION SELECT injection you need to guess how may columns there are in a table. This can take plenty of time and many times it is not sure you got a proper result. This next vector outputs the exact amount of columns in a secondary table. it only works if the PHP script echoes back errors, which probably is standard practice by programmers.
That's why error/file disclosure can help us.
MySQL Cheat Sheet
1 AND(SELECT * FROM table2 ) = 1
In the query:
SELECT * FROM table where id = 1 AND(SELECT * FROM table2 ) = 1
This outputs: "Operand should contain N column(s)"
where N is the number of columns in table 2
这是一条镜像帖。来源：北邮人论坛 / security / #12111同步于 2007/6/20
该镜像源已超过 30 天没有更新，可能在源站已被删除。
Security机器人发帖
Some SQL Injection Research
flyingkisser
2007/6/20镜像同步0 回复
订阅后，新回复会通过你的通知中心匿名送达。
0 条回复
暂无回复 · 你可以订阅本帖等待新回复。