当前位置：网站首页>sqlilabs less10

sqlilabs less10

2022-07-01 14:15:00 【It's always late at night.】

The tenth and ninth levels
Insert picture description here
Quick judgment is character double quotation mark injection

Insert picture description here
Judging the number of columns

use burp suite Complete the next steps
Inject database name
burp suite After catching it, throw it into intruder It's for substr The intercepted bit and the possible value of the intercepted bit plus $$ Variable symbols

Attack type selection cluster bomb
Insert picture description here

Then go to the load and give two variables to the range
Insert picture description here

Insert picture description here
The table name and field name are the same

It's too slow to wait for it to finish , You can check whether it is .
Code in Blogger less9 Just change single quotation marks into double quotation marks .