Mysql数据库的mysql Schema 到底有哪些东西& 手工注入的基础要领
时间：2014-05-20 15:05:07
收藏：0
阅读：456
#查看数据库版本
mysql> select @@version;
+------------+
| @@version |
+------------+
| 5.5.16-log |
+------------+
1 row in set (0.00 sec)
mysql> select * from information_schema.schemata; # 保存了系统的所有的数据库名 ，关键的字段是schema_name
# 2 rows in set (0.04 sec)表示只有2个数据库
+--------------+--------------------+----------------------------+------------------------+----------+
| catalog_name | schema_name | default_character_set_name | default_collation_name | sql_path |
+--------------+--------------------+----------------------------+------------------------+----------+
| def | information_schema | utf8 | utf8_general_ci | null |
| def | test | gb2312 | gb2312_chinese_ci | null |
+--------------+--------------------+----------------------------+------------------------+----------+
mysql> select * from information_schema.columns; #
# 关键的字段是table_name & column_name 411 rows in set (0.05 sec)
+---------------+--------------------+---------------------------------------+-------------------------------+------------------
| table_catalog | table_schema | table_name | column_name | ordinal_position | column_default | is_nullable | data_type |
character_maximum_length | character_octet_length | numeric_precision | numeric_scale | character_set_name | collation_name | column_type | column_key | extra
| privileges | column_comment |
mysql> select count(*) from information_schema.tables; # count(*)返回一共有多少行（就是多少条记录）
+----------+
| count(*) |
+----------+
| 38 |
+----------+
1 row in set (0.00 sec)
#关键的字段是table_column & table_name
+---------------+--------------------+---------------------------------------+-------------+--------+---------+------------+--
| table_catalog | table_schema | table_name | table_type | engine | version | row_format | table_rows | avg_row_length | data_length |
max_data_length | index_length | data_free | auto_increment | create_time | update_time | check_time | table_collation | checksum | create_options |
table_comment |
+---------------+--------------------+---------------------------------------+-------------+--------+---------+------------+--
mysql> select * from information_schema.tables where table_schema="test";
# 关键字是table_name和table_schema (数据库名)
+---------------+--------------+------------+------------+--------+---------+------------+------------+----------------+-----
| table_catalog | table_schema | table_name | table_type | engine | version | row_format | table_rows | avg_row_length | data_length | max_data_length | index_length |
data_free | auto_increment | create_time | update_time | check_time | table_collation | checksum | create_options | table_comment |
+---------------+--------------+------------+------------+--------+---------+------------+------------+----------------+-----
| def | test | t_users | base table | innodb | 10 | compact | 0 | 0 | 16384 | 0 | 16384 | 9437184 | 1 | 2012-10
-06 12:21:23 | null | null | gb2312_chinese_ci | null | | |
+---------------+--------------+------------+------------+--------+---------+------------+------------+----------------+-----
1 row in set (0.00 sec)
mysql> select * from information_schema.columns where table_name="t_users";
# 关键是得到 column_name
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+----
| table_catalog | table_schema | table_name | column_name | ordinal_position | column_default | is_nullable | data_type | character_maximum_length |
character_octet_length | numeric_precision | numeric_scale | character_set_name | collation_name | column_type | column_key | extra | privileges |
column_comment |
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+----
| def | test | t_users | id | 1 | null | no | int | null | null | 10 | 0 | null |
null | int(11) | pri | auto_increment | select,insert,update,references | |
| def | test | t_users | name | 2 | null | no | text | 65535 | 65535 | null | null | gb2312
| gb2312_chinese_ci | text | | | select,insert,update,references | |
| def | test | t_users | password | 3 | null | no | text | 65535 | 65535 | null | null | gb2312
| gb2312_chinese_ci | text | | | select,insert,update,references | |
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+----
3 rows in set (0.01 sec)
mysql> select "id","password" from information_schema.columns where table_name="t_users";
# 注意当要查询的变量是常数的时候就是空查询，返回的一定就是你的查询常量，一般是在union的查询里确定
显示位置而用的
+----+----------+
| id | password |
+----+----------+
| id | password |
| id | password |
| id | password |
+----+----------+
3 rows in set (0.02 sec)
mysql> use test; #使用该数据库
database changed
mysql> select * from test;
error 1146 (42s02): table ‘test.test‘ doesn‘t exist
mysql> select * from t_users;
empty set (0.00 sec)
这样就不需要再猜用户名和密码啦
insert into `t_users`(`id`, `name`, `password`) values (001,‘张三疯‘,‘123456‘);
#插入一条记录之后
mysql> select * from t_users;
+----+--------+----------+
| id | name | password |
+----+--------+----------+
| 1 | 张三疯 | 123456 |
+----+--------+----------+
1 row in set (0.00 sec)
#如果没有权限添加，就只有逐位猜值啦
mysql> select count(*) from t_users where len(password)=12;
error 1305 (42000): function test.len does not exist
mysql>
# 二分查找法
#这里报错啦，该函数不存在，在mysql是length()在access里是len();
mysql> select count(*) from t_users where length(password)=12;
error 1305 (42000): function test.len does not exist
#首先确定了密码的长度
mysql> select password from t_users where length(password)<6;
empty set (0.00 sec)
mysql> select password from t_users where length(password)>6;
empty set (0.00 sec)
mysql> select password from t_users where length(password)=6;
+----------+
| password |
+----------+
| 123456 |
+----------+
1 row in set (0.00 sec)
#再进行逐位猜值
select * from t_users where asc(left(password,1))>0;
mysql> select password from t_users where left(password,1)<1;
empty set (0.00 sec)
mysql> select password from t_users where left(password,1)<2;
+----------+
| password |
+----------+
| 123456 |
+----------+
#函数执行并成功返回，说明第一位的值就是1
#或者直接查询密码:
mysql> select password from t_users where length(‘password‘)>0;
+----------+
| password |
+----------+
| 123456 |
+----------+
1 row in set (0.00 sec)
mysql> select password from t_users where ascii(left(password,1))<2;
empty set (0.00 sec)
#在mysql里面什么函数都要写全啦，在acess里直接就是asc();
mysql> select password from t_users where ascii(left(password,1))=49;
+----------+
| password |
+----------+
| 123456 |
#可以直接擦每一位的值，也可以查acs值，但是直接查值是快些
#这样直到猜完length(password)位为止
#但是中文的名字不好猜啊，1个字，2个字节
>>> int("张")
traceback (most recent call last):
file "<stdin>", line 1, in <module>
valueerror: invalid literal for int() with base 10: ‘\xd6\xec‘
>>>
>>> chr(66)
‘b‘
>>>
#其实还是可以查的
mysql> select password from t_users where left(name,1)="张";
+----------+
| password |
+----------+
| 123456 |
+----------+
1 row in set (0.00 sec)
mysql> select password from t_users where left(name,2)="张";
empty set (0.00 sec)
#记住left是返回的所有的左边的值哈
mysql> select password from t_users where left(name,2)="张三";
+----------+
| password |
+----------+
| 123456 |
+----------+
#mid(匹配的字段，从第几个开始，取几个);可以完成逐位比较
mysql> select password from t_users where mid(name,2,1)="三";
+----------+
| password |
+----------+
| 123456 |
+----------+
1 row in set (0.00 sec)
mysql> select @@version;
+------------+
| @@version |
+------------+
| 5.5.16-log |
+------------+
1 row in set (0.00 sec)
mysql> select * from information_schema.schemata; # 保存了系统的所有的数据库名 ，关键的字段是schema_name
# 2 rows in set (0.04 sec)表示只有2个数据库
+--------------+--------------------+----------------------------+------------------------+----------+
| catalog_name | schema_name | default_character_set_name | default_collation_name | sql_path |
+--------------+--------------------+----------------------------+------------------------+----------+
| def | information_schema | utf8 | utf8_general_ci | null |
| def | test | gb2312 | gb2312_chinese_ci | null |
+--------------+--------------------+----------------------------+------------------------+----------+
mysql> select * from information_schema.columns; #
# 关键的字段是table_name & column_name 411 rows in set (0.05 sec)
+---------------+--------------------+---------------------------------------+-------------------------------+------------------
| table_catalog | table_schema | table_name | column_name | ordinal_position | column_default | is_nullable | data_type |
character_maximum_length | character_octet_length | numeric_precision | numeric_scale | character_set_name | collation_name | column_type | column_key | extra
| privileges | column_comment |
+---------------+--------------------+---------------------------------------+-------------------------------+------------------
mysql> select count(*) from information_schema.tables; # count(*)返回一共有多少行（就是多少条记录）
+----------+
| count(*) |
+----------+
| 38 |
+----------+
1 row in set (0.00 sec)
#关键的字段是table_column & table_name
+---------------+--------------------+---------------------------------------+-------------+--------+---------+------------+--
| table_catalog | table_schema | table_name | table_type | engine | version | row_format | table_rows | avg_row_length | data_length |
max_data_length | index_length | data_free | auto_increment | create_time | update_time | check_time | table_collation | checksum | create_options |
table_comment |
+---------------+--------------------+---------------------------------------+-------------+--------+---------+------------+--
mysql> select * from information_schema.tables where table_schema="test";
# 关键字是table_name和table_schema (数据库名)
+---------------+--------------+------------+------------+--------+---------+------------+------------+----------------+-----
| table_catalog | table_schema | table_name | table_type | engine | version | row_format | table_rows | avg_row_length | data_length | max_data_length | index_length |
data_free | auto_increment | create_time | update_time | check_time | table_collation | checksum | create_options | table_comment |
+---------------+--------------+------------+------------+--------+---------+------------+------------+----------------+-----
| def | test | t_users | base table | innodb | 10 | compact | 0 | 0 | 16384 | 0 | 16384 | 9437184 | 1 | 2012-10
-06 12:21:23 | null | null | gb2312_chinese_ci | null | | |
+---------------+--------------+------------+------------+--------+---------+------------+------------+----------------+-----
1 row in set (0.00 sec)
mysql> select * from information_schema.columns where table_name="t_users";
# 关键是得到 column_name
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+----
| table_catalog | table_schema | table_name | column_name | ordinal_position | column_default | is_nullable | data_type | character_maximum_length |
character_octet_length | numeric_precision | numeric_scale | character_set_name | collation_name | column_type | column_key | extra | privileges |
column_comment |
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+----
| def | test | t_users | id | 1 | null | no | int | null | null | 10 | 0 | null |
null | int(11) | pri | auto_increment | select,insert,update,references | |
| def | test | t_users | name | 2 | null | no | text | 65535 | 65535 | null | null | gb2312
| gb2312_chinese_ci | text | | | select,insert,update,references | |
| def | test | t_users | password | 3 | null | no | text | 65535 | 65535 | null | null | gb2312
| gb2312_chinese_ci | text | | | select,insert,update,references | |
+---------------+--------------+------------+-------------+------------------+----------------+-------------+-----------+----
3 rows in set (0.01 sec)
mysql> select "id","password" from information_schema.columns where table_name="t_users";
# 注意当要查询的变量是常数的时候就是空查询，返回的一定就是你的查询常量，一般是在union的查询里确定
显示位置而用的
+----+----------+
| id | password |
+----+----------+
| id | password |
| id | password |
| id | password |
+----+----------+
3 rows in set (0.02 sec)
mysql> use test; #使用该数据库
database changed
mysql> select * from test;
error 1146 (42s02): table ‘test.test‘ doesn‘t exist
mysql> select * from t_users;
empty set (0.00 sec)
这样就不需要再猜用户名和密码啦
insert into `t_users`(`id`, `name`, `password`) values (001,‘张三疯‘,‘123456‘);
#插入一条记录之后
mysql> select * from t_users;
+----+--------+----------+
| id | name | password |
+----+--------+----------+
| 1 | 张三疯 | 123456 |
+----+--------+----------+
1 row in set (0.00 sec)
#如果没有权限添加，就只有逐位猜值啦
mysql> select count(*) from t_users where len(password)=12;
error 1305 (42000): function test.len does not exist
mysql>
# 二分查找法
#这里报错啦，该函数不存在，在mysql是length()在access里是len();
mysql> select count(*) from t_users where length(password)=12;
error 1305 (42000): function test.len does not exist
#首先确定了密码的长度
mysql> select password from t_users where length(password)<6;
empty set (0.00 sec)
mysql> select password from t_users where length(password)>6;
empty set (0.00 sec)
mysql> select password from t_users where length(password)=6;
+----------+
| password |
+----------+
| 123456 |
+----------+
1 row in set (0.00 sec)
#再进行逐位猜值
select * from t_users where asc(left(password,1))>0;
mysql> select password from t_users where left(password,1)<1;
empty set (0.00 sec)
mysql> select password from t_users where left(password,1)<2;
+----------+
| password |
+----------+
| 123456 |
+----------+
#函数执行并成功返回，说明第一位的值就是1
#或者直接查询密码:
mysql> select password from t_users where length(‘password‘)>0;
+----------+
| password |
+----------+
| 123456 |
+----------+
1 row in set (0.00 sec)
mysql> select password from t_users where ascii(left(password,1))<2;
empty set (0.00 sec)
#在mysql里面什么函数都要写全啦，在acess里直接就是asc();
mysql> select password from t_users where ascii(left(password,1))=49;
+----------+
| password |
+----------+
| 123456 |
#可以直接擦每一位的值，也可以查acs值，但是直接查值是快些
#这样直到猜完length(password)位为止
#但是中文的名字不好猜啊，1个字，2个字节
>>> int("张")
traceback (most recent call last):
file "<stdin>", line 1, in <module>
valueerror: invalid literal for int() with base 10: ‘\xd6\xec‘
>>>
>>> chr(66)
‘b‘
>>>
#其实还是可以查的
mysql> select password from t_users where left(name,1)="张";
+----------+
| password |
+----------+
| 123456 |
+----------+
1 row in set (0.00 sec)
mysql> select password from t_users where left(name,2)="张";
empty set (0.00 sec)
#记住left是返回的所有的左边的值哈
mysql> select password from t_users where left(name,2)="张三";
+----------+
| password |
+----------+
| 123456 |
+----------+
#mid(匹配的字段，从第几个开始，取几个);可以完成逐位比较
mysql> select password from t_users where mid(name,2,1)="三";
+----------+
| password |
+----------+
| 123456 |
+----------+
1 row in set (0.00 sec)
评论（0）