Boolean blind injection of sqlmap blasting
——————————————————————————— It
hasn’t been updated for a long time, and the sentence is almost forgotten…. As a rookie, I finally understood this question and the meaning of some sentences. I will express it in as detailed and understandable language as possible.
sqlmap blasting (first you have to download sqlmap, which happens to be in csdn)
Injection statement: python sqlmap.py -u"XXXXX" -batch is the basic injection framework.
1. The library name of the blasting database
Input: python sqlmap.py -u"http://challenge-cb6615ef28a95b3d.sandbox.ctfhub.com:10080/?id=1" -batch -dbs
Result:
python sqlmap.py -u"XXX" -batch is the basic structure XXXX means to inject "-" into the URL to point to the data that needs to be blasted. "-Dbs" points to the database.
The figure shows the type of database searched:
2. Blasting the name of the table in the current database
Input: python sqlmap.py -u"http://challenge-8400f0508f0ba587.sandbox.ctfhub.com:10080/?id=1" -batch -D"sqli" -tables
Here "D" means the database, and "-tables" points to the name of the blasting table.
Result:
Get the two table names flag and news.
3. Blasting column name
Input: python sqlmap.py -u"http://challenge-8400f0508f0ba587.sandbox.ctfhub.com:10080/?id=1" -batch -D"sqli" -T"flag" -columns
"-T" means table name, "-columns" points to blasting column name
Result:
The data type obtained is varchar (VARCHAR(M) is a more flexible data type than CHAR. It is also used to represent character data, but VARCHAR can store a variable-length character string.) It is variable here because Here is that the flag in ctfhub is different every time and the flag is a character so it belongs to varchar.
4. Blast the data
input: python sqlmap.py -u"http://challenge-8400f0508f0ba587.sandbox.ctfhub.com:10080/?id=1" -batch -D"sqli" -T"flag" -C"flag" -dump
"C" is the column name, and "-dump" is the meaning of exporting data.
result:
Successfully obtained the flag.
If you are not familiar with it, you can use this to blast SQL integer and character types.
You can also learn about manual injection, but it is a bit troublesome.