web third experiment -SQL injection

A, SQL Overview (abbreviated)

Second, the numeric injection (POST)

Pick a 1

 

 

burp capture.

 

 

 

 

repair it a little. Change

1 or 1 = 1 
sent to the repeater 
all out, into success.

 

 

Third, the character injection (ge t)

Enter kobe.

 

 

 

 

If a random input, such as sasori.

Prompts for user does not exist.

 

 

 

Continue to test:

 

 

 

success.

 

 

 

Fourth, search type implant.

"Enter the part of the user name" to find it, you may use the li ke a kind of database search logic.

Try this

k%‘ or 1=1#

 

 

em mmm casually enter a first look at such a

 

 

 

 

It can contain parts of the query

And it should be used like%

For example,% name%

Try a% 'or 1 = 1 #

 

 

Five, XX-type implant

And third like, to try to build brackets admin ') or 1 = 1 #

 

 

 

kele

Six, insert / update / delete injection

In the user-input single quotes, random password.

 

 

 

Implanting under given based insert. Construction adminminmin 'or updatexml (1, concat (0x7e, database ()), 0) or'

 

 

 

delete injection: