Will find out such only then enumerates?
Then we want are cause the enumeration which UNION inquires with the enumeration which this time inquires to be equal. That does not report
Wrong can be equal.
Starts from the first row to guess first, then must this sentence union the select 1 structure in the middle of the address procedure sentence.
Then the sentence is mysqlInject.jsp? id=1' and union select 1 and ''= ' like this.
Some people asked why behind (green part) can add on and ''= '? Perhaps everybody recorded, our SQL language
The sentence is needs two to contain the mark, sentence select * from account where accountId = '1 ' I
What inputs is in 1 that position, behind must therefore remove ', otherwise the sentence bulletin is wrong.
In this procedure is also ', if you if wants to eliminate ' has many means that to let everybody understand therefore I use and now
''= '.
Says first several means eliminate this '
1. Uses and ''= ', although insufficiently convenient, but the bulletin is not wrong in the complex SQL sentence.
2. The use annotation # or/**/, may fall like the following thing complete annotation, but has a major problem,
Is in execution complex SQL sentence time has the possibility bulletin to be wrong.
Some people test, well? Why did I add # the bulletin to be wrong? Because this time is uses GET to pass on the senate, in address fence biography
Senate. Everybody thinks that what appearance initially downloaded the belt # name the database was? Oh, has been right, # was the address fence's conclusion symbol,
That is # all does not spread including # later character. Therefore # pours from the top into the GET pattern pours into does not have an effect.
Then some tools write in structure injection time why is
mysqlInject.jsp? id=1'/** /and/ ** /union/ ** /select/ ** /1/ ** /and/ **/''
/**/=/**/'/*? Because has the function inside the procedure to be possible to spread inside the parameter the blank space elimination, if removes
The blank space, will be the procedure has had the wrong sentence, then has reported is wrong. Therefore some tools are with/**/this
Planted the thing to substitute for the blank space.
What that/is **/also? /**/is one kind of annotation, the named documents annotation, was starts from/* until */to finish,
Any code can become the annotation, therefore is the programmer in writes when the massive annotations uses one kind of annotation.
What that final is/*? That uses for to solve the SQL sentence to contain the mark not to form a pair.
We start to test.
mysqlInject.jsp? id=1 '/** /union/ ** /select/ ** /1/*
select * from account where accountId = '1
'/** /union/ ** /select/ ** /1/*'.
Has noted the lowest those words?
javax.servlet.ServletException: The used SELECT statements have a
different number of columns
The general meaning is” this use inquiry enumeration is different”, from this obtained this inquiry not to inquire a table.
Ex analogia, select 1 select 1,2 select 1,2,3 know the correct position, then you said now writes enumeration
Other pages: : <<Prev * 1 * 2 * 3 * 4 * 5 * 6 * Next>>
|
You are here: hacking technology
> hacker course
> Content
Category: Home
> hacker course