php注入教程,你掌握了多少（PHP injection tutorial, how much have you mastered）.docVIP

php注入教程,你掌握了多少（PHP injection tutorial, how much have you mastered） PHP injection tutorial, how much have you mastered? Reading: 177 time: 2009-8-11 6:38:26 Excerpt from: /isno/blog/item/51edc75c1fa7a444faf2c00a.html In this era of popular injection, the number of carrying tools around rookie charge. If you dont want to become a tool slave, do not want to encounter PHP away, dont want to do a ASP rookie of the group, do not want to would you please calm down, I walk together with the whole intrusion detection process. I believe you will can be harvested. Not only in technology, more thinking, more in consciousness. To determine whether there is injection: first of all, as PHP and ASP determine the injection, in a dynamic connection followed by the and 1=1 and 1=2, the return result can be judged. Two return results are not the same, you can have a preliminary judge for the injection point. Judge the field size: next, to deal with the PHP guessing field, we use the order by. syntax as follows: Http:///1.php? Id=1 order by 40 / / if returned to normal, indicating the actual field should be greater than 40. So we have to continue to add. Return error. For example, when /1.php id=1 order by 45 is wrong, then we know the field size is 44. After UNION SELECT: knows the field size, well list all fields using the union select union query Http:///1. php？ID = 1，1 = 2联盟选择1,2,3,4 ~ 44 / * / /这里我们列出了44个字段，并且以/ *告诉MySQL，我们的命令已经执行完毕*。 你就可以在回显出来的相应的字段上，替换你要查询的字段名，再从表明。就可以得到相应的字段内容了。譬如： /1.php？ID = = 2和1 ~联盟选择1,2,3,4，30，32，45个，~会员/ * / / ~表示我这里省略。你不能那么写。 几个常用的MySQL函数：好了，现在我们把字段都列出来了。估计这时候有人就该急急忙忙的加从来猜密码了。实际上，猜测密码走后台这一招，我们应该放在最后。有人说MySQL的功能，和访问一样，甚至还不如，这其实是误解，冤枉了MySQL。我们下面来看看，MySQL都有些什么高级的运用。 这里首先列出几个常用的涵数：1：2：3：system_user() user() current_user4：session_user() 5：6：7：database() version() load_file() 他们的含义分别如下： 1：系统用户名。2：用户名。3：当前用户名：4连接数据库的用户名。5：数据库名。6：数据库版本。7：MySQL读取本地文件的函数 他们都有什么用？1-6的作用如下： 这几个函数翻回来的信息在检测过程中具有非常重要的作用，他们对我们了解目标，分析目标，寻找漏洞，开阔思路等等都有莫大的作用。 For example, understanding the v