Was this inquiry enumeration.
Everybody saw underground returns to 1|2|3|, this value is merges from ours UNION inquiry comes out. Tries UNION
SELECT 1,2,3 change into UNION SELECT 4,5,6 to have a look. Underground has programmed 4|5|6|?
Some people said how you are I who deceives people trade, I traded to 789 had not come out, the reality original data, you deceived
Human; I have not deceived people, I will not deceive people; Why can't that come out?
Some procedures write time is only the data returns set first line of output, but the UNION inquiry later will be the data merging
After this inquiry, then he has only output this inquiry data, actually the UNION inquiry's data also has, but he has not lost
Leaving. How does that manage? The intelligent person certainly will think. , So that's how it is, so long as let this inquiry not output may. Ha,
I have been intelligent, but how to let this inquiry not output? Tells everybody first a simple method, has a look at the SQL sentence, we are
Has made the limiting condition. Where accountid =? , then i.e. lets this accoundId limit to one does not have
On some id not will that not have? The heart movement is inferior to move, tries.
mysqlInject.jsp? id=1000'/** /union/ ** /select/ ** /4,5,6/*
select * from account where accountId
=1000'/** /union/ ** /select/ ** /4,5,6/*
Ha, really did not have!!! The attention green's part, assigns to inquire no id, then he natural can
Evaporated.
2.3 low probability kinds guess this inquiry row quantity in addition
Although this method probability low spot, but will reduce the work load greatly. The power of exponent law is only suitable for the select * simplicity
SQL sentence.
What this method is with is in the mysql order sorting. Sorting is defers to the smooth platoon to get down. We write one
SQL sentence. Select * from account where accountId = '1 ' order by accountId
Then this SQL sentence is also rises foreword sorting according to accountId. Then we did not know how he does have anything to manage, moreover
How did this guess? Here is the key question. A MYSQL support row serial number sorts Select * from account where
accountId = '1 ' order by 1 like this also defers to the first row sorting.
Oh, you are deceiving us, how sorts to guess a row quantity? Then I do not exist according to one row sorting? For instance fourth
Row? On your common body has 3 pockets, one most 10 Yuan, one day eat, 3 catties rice, catty rice one Yuan, but your now
The day has eaten 4 catties rice, needs 40 Yuan, you actually only then 3 pockets, you do not have 40 Yuan, you must come under attack.
That is altogether some 3 rows, order by 3, according to the 3rd row sorting, normal, order by 4, according to 4th
A row sorting, does not have the 4th row, makes a mistake. Then also explained that he has 4 row.
This method is judges according to person's experience. I use this method to be able generally to succeed, is not successful the difference not to be also many.
2.4 use UNION to guess other tables, inquires other tables
Other pages: : <<Prev * 1 * 2 * 3 * 4 * 5 * 6 * Next>>
|
You are here: hacking technology
> hacker course
> Content
Category: Home
> hacker course