DVWA Series 2 Low level SQL injection

Set the security level to on, select SQL injection in the list on the left, and then enter a different number in the User ID text box on the right to display the appropriate user information.

We first need to determine whether the parameters transmitted here are text or digital, enter 3 and 1+2 respectively, and observe that they show inconsistent results, thus judging the type of the parameter is text type.

Click "View Source" in the lower right corner of the page to view the source code, the most important of which is the two lines of statements as shown:

650) this.width=650; "title=" 1.jpg "src=" Http://s2.51cto.com/wyfs02/M01/76/CC/wKiom1Zc5Q7AWd-JAAAZ69R0bxk367.jpg " alt= "Wkiom1zc5q7awd-jaaaz69r0bxk367.jpg"/>

The first line is to get the value passed by the user through the ID parameter and assign the value to the variable ID, the second line is to assign a SELECT statement to the variable $getid,select statement to find the values of the first_name and last_name two fields from the Users table. The condition is that the value of the user_id field matches the value entered by the user.

Here we enter "' or 1=1 #" in the text box to display all the data in the Users table:

650) this.width=650; "title=" 2.jpg "src=" Http://s4.51cto.com/wyfs02/M00/76/CC/wKioL1Zc5ePRL5ZRAADYOesjdu0388.jpg " alt= "Wkiol1zc5eprl5zraadyoesjdu0388.jpg"/>

Insert the statement we entered into the source code:

$getid = "Select First_Name, last_name from users WHERE user_id = ' or 1=1 # '";

For text-type injection, it is important to consider the problem of closing the quotation marks. #是MySQL中的注释符, it disables all subsequent content.

Let's practice the previous manual MySQL injection process.

First Enter ' Union Select # # ' to determine that the number of fields is 2, and that two fields can be queried by substituting parameters.

Enter ' Union Select # # ' to detect that the MySQL version is 5.0 and the current database name is DVWA.

Enter "' Union select table_name,2 from Information_schema.tables where table_schema= ' Dvwa ' #" burst DVWA database with two tables: Guestbook, Users, of whom we are concerned is obviously the users.

Enter "union select column_name,2 from Information_schema.columns where table_name= ' users ' #" to burst the fields in the Users table.

Enter "union select User,password from users #" to burst the user name and password.

This article from "a pot of turbid wine" blog, reproduced please contact the author!

DVWA Series 2 Low level SQL injection