当前位置:网站首页>SQL injection 2
SQL injection 2
2022-07-06 20:17:00 【Fan Pei West】
Blind note
What should we do when our injection statement is brought into the database query but nothing is returned ? for example
Boolean type sql Blind note
substr() function
substr(string,start,length)
string( It's necessary ) Specifies that a part of the string to be returned .start( It's necessary ) Specify where to start the string .length( Optional ) Specifies the length of the returned string .
The following results 1 It's true ,0 For false
Manual blind injection is usually not used in actual operation , have access to sqlmap And other tools to increase the efficiency of blind Injection .
Time type sql Blind note
Enter last vince’ and ascii(substr(database(),1,1))=112#, The returned information finds that there is no injection point . Then you can't inject ? But in fact, it can be injected through the execution time of the back end .
Then you can use tools to measure
Wide byte Injection
Premise :mysql The coding set of is gbk And magic quotation mark escape is checked
边栏推荐
- An East SMS login resurrection installation and deployment tutorial
- 夏志刚介绍
- 22-07-05 七牛云存储图片、用户头像上传
- 范式的数据库具体解释
- Crawler (14) - scrape redis distributed crawler (1) | detailed explanation
- 数据的同步为每个站点创建触发器同步表
- HDU 1026 Ignatius and the Princess I 迷宫范围内的搜索剪枝问题
- golang的超时处理使用技巧
- 腾讯云数据库公有云市场稳居TOP 2!
- BUUCTF---Reverse---easyre
猜你喜欢
5. 无线体内纳米网:十大“可行吗?”问题
腾讯字节等大厂面试真题汇总,网易架构师深入讲解Android开发
案例 ①|主机安全建设:3个层级,11大能力的最佳实践
Node. Js: express + MySQL realizes registration, login and identity authentication
腾讯字节阿里小米京东大厂Offer拿到手软,老师讲的真棒
Speech recognition (ASR) paper selection: talcs: an open source Mandarin English code switching corps and a speech
系统与应用监控的思路和方法
Jupyter launch didn't respond after Anaconda was installed & the web page was opened and ran without execution
22-07-05 upload of qiniu cloud storage pictures and user avatars
PowerPivot——DAX(初识)
随机推荐
Is it difficult for small and micro enterprises to make accounts? Smart accounting gadget quick to use
22-07-05 upload of qiniu cloud storage pictures and user avatars
How to handle the timeout of golang
A5000 vGPU显示模式切换
【GET-4】
【云原生与5G】微服务加持5G核心网
Discussion on beegfs high availability mode
5. 無線體內納米網:十大“可行嗎?”問題
Redisson bug analysis
Crawler (14) - scrape redis distributed crawler (1) | detailed explanation
Continuous test (CT) practical experience sharing
Zoom with unity mouse wheel: zoom the camera closer or farther
Tencent T4 architect, Android interview Foundation
js获取浏览器系统语言
AsyncHandler
使用ssh连接被拒
微信小程序常用集合
js实现力扣71题简化路径
BUUCTF---Reverse---easyre
腾讯T2大牛亲自讲解,跳槽薪资翻倍