"Sqli-labs" Less16 post-blind-boolian/time based-double quotes (double-quote POST blind based on BOOL/time delay)

 1' or 1=1# and              fail 1 "or 1=1#              1=1#--             fail 11=1 #             --> Success                            

Judging by double-quote deformation injection

Using the Sleep function to determine the database name length

1 or if (Length (database())=7,1, Sleep (5)) #

Time delay does appear, but not 5s

Execute it in the database

+

There are 13 data in the Users table, where a condition match occurs because sleep (5) returns 1 (true) so look for username= ' 1 ', that is, the condition behind the where executes 13 times, the delay is 65s

So do not use or sleep () to inject

Conversely, if a large number of such requests are constructed, a large number of database connections are abused, causing normal service to fail

Reference http://www.freebuf.com/articles/web/101658.html

"Sqli-labs" Less16 post-blind-boolian/time based-double quotes (double-quote POST blind based on BOOL/time delay)