Sqli-labs (13) (HPP)

29th Pass

The intervention is that there is a WAF, which is really just a scenario for simulating a waf, meaning that the variables handled by WAF are inconsistent with the variables accepted by the daemon.

Test the parameters of pollution, specific can refer to other articles on the HPP interpretation.

First look at the source bar:

Input? id=1&id= ' Union Select 1,database (), 3--%20

Can see I print this 1, this is the WAF processing variables, that is, the previous ID, after the program is accepting the ID variable is the next one, this is the HTTP parameter pollution vulnerability.

A picture of the drawings

30th Pass:

Similar to the 29th pass, change the single quotation mark to double quotation marks

31st Pass:
Similarly, parentheses are required.

Sqli-labs (13) (HPP)