注入经验（Experience in injection）.docVIP

注入经验（Experience in injection） Experience in injection Some people filter Select, Update, and Delete key words, but they forget to distinguish them, so you can try it with Select. 2. When you cant guess the name of the field, look at the login form on the website. For convenience, the field name is the same name as the input field of the form. 3. Special attention: when the + number of the address bar is introduced into the program, it is interpreted as a space, and % 2B is interpreted as +, and % 25 is interpreted as % number, which can refer to the relevant introduction of URLEncode. When you inject it with a Get method, IIS records all your submitted strings and does not record the Post method, so you can use the Posts url as much as possible. 4. Guess solution can only use Ascii decoding method, word by word when Access is essentially can also use this method, you just need to difference between the two, but if use is essentially an error information exposed the value, the efficiency and accuracy will be greatly improved. A few places to pay attention to when oracle is injected 1) when OracIe is injected, the type of union statement must match, otherwise the query will not be successful. The type of character, type, and date type that is common to the oracle type is typically used to make union queries and display character types and numeric types. Structure in front of the union select1, 2,3,4,5,6,7,8,9,10,11,1213,14,15,16 the SQL statement is behind the union of the all numeric types, and must have in front of the other types, so cant query success. Oracle will not do your own data type conversion, but oracle can use NULL to match all the data types, so we can all SeIectNULL first, and then examine the union before the select type. 2) the select statement must be followed by the table name, otherwise the query will not be successful. SeIect such statements 1, 2, 3 in essentially and MySQL can be successfully executed, but in oracIe must add the name of the tabl