DVWA Series 5 SQL injection (Blind)

The so-called blind refers to when we enter some special characters, the page does not display error prompts, so that we can only be judged by whether the page is normal display.

Set DVWA security to Low, and then select SQL Injection (Blind) to view the Web page source code. It can be found that, unlike before, an @ symbol was added before the mysql_numrows () function, followed by a comment stating that the @ symbol can suppress the error message.

650) this.width=650; "Style=" background-image:none;border-bottom:0px;border-left:0px;padding-left:0px; padding-right:0px;border-top:0px;border-right:0px;padding-top:0px; "title=" image "border=" 0 "alt=" image "src=" http ://s3.51cto.com/wyfs02/m01/77/0f/wkiol1zikapbp7otaacift5uyzo905.png "height="/>

The blinds actually do not have much effect on infiltration, and we can still display all the data by entering "or 1=1 #". The entire infiltration process is also consistent with the previous basic.

This article from "a pot of turbid wine" blog, reproduced please contact the author!

DVWA Series 5 SQL injection (Blind)