码迷,mamicode.com
首页 > 数据库 > 详细

Mysql数据库的mysql Schema 到底有哪些东西& 手工注入的基础要领

时间:2014-05-20 15:05:07      阅读:456      评论:0      收藏:0      [点我收藏+]

标签:mysql   手工注入mysql   mysql系统表   

#查看数据库版本
mysql> select @@version;
+------------+
| @@version  |
+------------+
| 5.5.16-log |
+------------+
1 row in set (0.00 sec)

mysql> select * from information_schema.schemata; # 保存了系统的所有的数据库名 ,关键的字段是schema_name
# 2 rows in set (0.04 sec)表示只有2个数据库
+--------------+--------------------+----------------------------+------------------------+----------+
| catalog_name | schema_name        | default_character_set_name | default_collation_name | sql_path |
+--------------+--------------------+----------------------------+------------------------+----------+
| def          | information_schema | utf8                       | utf8_general_ci        | null     |
| def          | test               | gb2312                     | gb2312_chinese_ci      | null     |
+--------------+--------------------+----------------------------+------------------------+----------+

mysql> select * from information_schema.columns;  #


# 关键的字段是table_name & column_name  411 rows in set (0.05 sec)

+---------------+--------------------+---------------------------------------+-------------------------------+------------------

| table_catalog | table_schema       | table_name                            | column_name                   | ordinal_position | column_default      | is_nullable | data_type | 


character_maximum_length | character_octet_length | numeric_precision | numeric_scale | character_set_name | collation_name    | column_type         | column_key | extra    


      | privileges                      | column_comment |

+---------------+--------------------+---------------------------------------+-------------------------------+------------------


mysql> select * from information_schema.tables;   # 包含所有的表名 ,38 rows in set (0.09 sec) 表示有38张表

mysql> select count(*) from information_schema.tables;  # count(*)返回一共有多少行(就是多少条记录)

+----------+
| count(*) |
+----------+
|       38 |
+----------+
1 row in set (0.00 sec)


#关键的字段是table_column & table_name 

+---------------+--------------------+---------------------------------------+-------------+--------+---------+------------+--

| table_catalog | table_schema       | table_name                            | table_type  | engine | version | row_format | table_rows | avg_row_length | data_length | 


max_data_length | index_length | data_free | auto_increment | create_time         | update_time         | check_time | table_collation   | checksum | create_options  | 


table_comment |
+---------------+--------------------+---------------------------------------+-------------+--------+---------+------------+--

mysql> select * from information_schema.tables where table_schema="test";


# 关键字是table_name和table_schema  (数据库名) 
+---------------+--------------+------------+------------+--------+---------+------------+------------+----------------+-----

| table_catalog | table_schema | table_name | table_type | engine | version | row_format | table_rows | avg_row_length | data_length | max_data_length | index_length | 


data_free | auto_increment | create_time         | update_time | check_time | table_collation   | checksum | create_options | table_comment |
+---------------+--------------+------------+------------+--------+---------+------------+------------+----------------+-----

| def           | test         | t_users    | base table | innodb |      10 | compact    |          0 |              0 |       16384 |               0 |        16384 |   9437184 |              1 | 2012-10


-06 12:21:23 | null        | null       | gb2312_chinese_ci |     null |                |               |
+---------------+--------------+------------+------------+--------+---------+------------+------------+----------------+-----

1 row in set (0.00 sec)


mysql> select * from information_schema.columns where table_name="t_users";


# 关键是得到 column_name


+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+----

| table_catalog | table_schema | table_name | column_name | ordinal_position | column_default | is_nullable | data_type | character_maximum_length | 


character_octet_length | numeric_precision | numeric_scale | character_set_name | collation_name    | column_type | column_key | extra          | privileges                      | 


column_comment |
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+----

| def           | test         | t_users    | id          |                1 | null           | no          | int       |                     null |                   null |                10 |             0 | null               | 


null              | int(11)     | pri        | auto_increment | select,insert,update,references |                |
| def           | test         | t_users    | name        |                2 | null           | no          | text      |                    65535 |                  65535 |              null |          null | gb2312   


          | gb2312_chinese_ci | text        |            |                | select,insert,update,references |                |
| def           | test         | t_users    | password    |                3 | null           | no          | text      |                    65535 |                  65535 |              null |          null | gb2312 


            | gb2312_chinese_ci | text        |            |                | select,insert,update,references |                |
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+----

3 rows in set (0.01 sec)


mysql> select "id","password" from information_schema.columns where table_name="t_users";

# 注意当要查询的变量是常数的时候就是空查询,返回的一定就是你的查询常量,一般是在union的查询里确定
显示位置而用的

+----+----------+
| id | password |
+----+----------+
| id | password |
| id | password |
| id | password |
+----+----------+
3 rows in set (0.02 sec)

mysql> use test;  #使用该数据库

database changed
mysql> select * from test;
error 1146 (42s02): table ‘test.test‘ doesn‘t exist
mysql> select * from t_users;
empty set (0.00 sec)

这样就不需要再猜用户名和密码啦

insert into `t_users`(`id`, `name`, `password`) values (001,‘张三疯‘,‘123456‘);
#插入一条记录之后


mysql> select * from t_users;
+----+--------+----------+
| id | name   | password |
+----+--------+----------+
|  1 | 张三疯 | 123456   |
+----+--------+----------+
1 row in set (0.00 sec)

#如果没有权限添加,就只有逐位猜值啦

mysql> select count(*) from t_users where len(password)=12;
error 1305 (42000): function test.len does not exist
mysql>

# 二分查找法

#这里报错啦,该函数不存在,在mysql是length()在access里是len();
mysql> select count(*) from t_users where length(password)=12;
error 1305 (42000): function test.len does not exist

#首先确定了密码的长度

mysql> select password from t_users where length(password)<6;
empty set (0.00 sec)

mysql> select password from t_users where length(password)>6;
empty set (0.00 sec)

mysql> select password from t_users where length(password)=6;
+----------+
| password |
+----------+
| 123456   |
+----------+
1 row in set (0.00 sec)

#再进行逐位猜值

 select * from t_users where asc(left(password,1))>0;
 
mysql> select password from t_users where left(password,1)<1;
empty set (0.00 sec)

mysql> select password from t_users where left(password,1)<2;
+----------+
| password |
+----------+
| 123456   |
+----------+
#函数执行并成功返回,说明第一位的值就是1

#或者直接查询密码:
 
 mysql> select password from t_users where length(‘password‘)>0;
+----------+
| password |
+----------+
| 123456   |
+----------+
1 row in set (0.00 sec)

mysql> select password from t_users where ascii(left(password,1))<2;
empty set (0.00 sec)

#在mysql里面什么函数都要写全啦,在acess里直接就是asc();

mysql> select password from t_users where ascii(left(password,1))=49;
+----------+
| password |
+----------+
| 123456   |

#可以直接擦每一位的值,也可以查acs值,但是直接查值是快些
#这样直到猜完length(password)位为止

#但是中文的名字不好猜啊,1个字,2个字节

>>> int("张")
traceback (most recent call last):
  file "<stdin>", line 1, in <module>
valueerror: invalid literal for int() with base 10: ‘\xd6\xec‘
>>>
>>> chr(66)
‘b‘
>>>

#其实还是可以查的

mysql> select password from t_users where left(name,1)="张";
+----------+
| password |
+----------+
| 123456   |
+----------+
1 row in set (0.00 sec)

mysql> select password from t_users where left(name,2)="张";
empty set (0.00 sec)

#记住left是返回的所有的左边的值哈
mysql> select password from t_users where left(name,2)="张三";
+----------+
| password |
+----------+
| 123456   |
+----------+

#mid(匹配的字段,从第几个开始,取几个);可以完成逐位比较
mysql> select password from t_users where mid(name,2,1)="三";
+----------+
| password |
+----------+
| 123456   |
+----------+
1 row in set (0.00 sec)

Mysql数据库的mysql Schema 到底有哪些东西& 手工注入的基础要领,布布扣,bubuko.com

Mysql数据库的mysql Schema 到底有哪些东西& 手工注入的基础要领

标签:mysql   手工注入mysql   mysql系统表   

原文地址:http://blog.csdn.net/l_f0rm4t3d/article/details/26289139

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!