Site has been hacked via SQL Injection

前端 未结 7 1232
难免孤独
难免孤独 2020-12-04 18:09

Recently my site was hacked via SQL injection. The hacker used the following query to get my DB name. I cannot understand this query they wrote.

Query:



        
7条回答
  •  陌清茗
    陌清茗 (楼主)
    2020-12-04 18:43

    This is an exemple of injection using Havij The 0x7e and 0x27 correspond to ~ and ' wich will be used to frame the HTML display such as id=999999.9+union+all+select+0x31303235343830303536,(select+concat(0x7e,0x27,unhex(Hex(cast(sample_tbl.name+as+char))),0x27,0x7e)+from+test.sample_tbl+Order+by+id+limit+0,1)+-- This query will render ~'Alfred'~ which is the field value of the column name, from the table sample_tbl in the table test

    ~'r3dm0v3_hvj_injection'~ is the Havij signature code unhex 0x7233646D3076335F68766A5F696E6A656374696F6E according to http://www.string-functions.com/hex-string.aspx

提交回复
热议问题