[zone]mysql 语法绕过一些WAF

Anonymous
1338 阅读
转:mysql syntax bypass some WAF

一个小tips,twitter上看见的:

一句话:

select{x table_name}from{x information_schema.tables}
测试:
mysql> select{x table_name}from{x information_schema.tables};
+----------------------------------------------------+
| table_name                                         |
+----------------------------------------------------+
| CHARACTER_SETS                                     |
| COLLATIONS                                         |
| COLLATION_CHARACTER_SET_APPLICABILITY              |
| COLUMNS                                            |
| COLUMN_PRIVILEGES                                  |
| ENGINES                                            |
..........

https://twitter.com/Black2Fan/status/564746640138182656

http://dev.mysql.com/doc/refman/5.6/en/date-and-time-literals.html#date-and-time-standard-sql-literals

http://dev.mysql.com/doc/refman/5.6/en/join.html#idm140714470997024

评论 (2)

liuyu
select{x table_name}from{x information_schema.tables} <p>请问,这个{ 在mysql怎么用?查了半天mysql手册也没查到。</p>
yzmm
新版支持 <p>http://dev.mysql.com/doc/refman/5.6/en/date-and-time-literals.html#date-and-time-standard-sql-literals</p> <p>http://dev.mysql.com/doc/refman/5.6/en/join.html#idm140714470997024</p>

发表评论