$data->bindParam( ':id', $id, PDO::PARAM_INT ) Prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1 ' ) However, due to the server-side execution of the SLEEP function, the accuracy based on time blind is influenced, and there is any one of the above two methods. At the same time, Limit 1 is added to the SQL query statement, I hope to use only one result.Īlthough Limit 1 is added, we can comment out by #. When the SQL query result is empty, the function SLEEP (Seconds) is executed, and the purpose is to disturb the time-based blind. It can be seen that the HIGH level code utilizes the cookie to pass the parameter ID. In addition, we can pass the SLEEP () function when constructed, if there is a delay represents true, otherwise false. Similar to the previous talk, we can change the packet by Burpsuite capture. It can be seen that the MEDIUM level code uses the mysql_real_escape_string function to escape the special symbol \ x00, \ n, \ r, ', ", \ x1a, and the front end page sets the drop-down selection form, I hope to control the user enter. Not deequate, the blind efficiency is relatively low. Judgment the name by one, derived for Guestbook users The ASCII () function determines that the ASCII code substr (A, B, c) starts from the position B, intercepting the A-character string C bit length converts it to the ASCII value.Įnter 1 'and ASCII (Substr (Database (), 1, 1)) = 100 #ġ 'and (select count (Table_name) from information_schema.tables where table_schema = Database ()) = 2 # Judging two tablesġ’ and length(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1))=9 # Look through the ASCII code to find the database name. Judgment input by length () function: 1 'and length (Database ()) = 4 # Returns the existence, it is determined that the database length is 4, in addition, we can judge the two-point method. It can be judged that the character type is injected. It can be seen that the LOW level source code does not filter the parameter ID, and the result of the SQL statement query returns only two "exissrs" or "missing", so use blind. ((is_null($_mysqli_res = mysqli_close($GLOBALS))) ? false : $_mysqli_res) ' 404 Not Found' ) Įcho 'User ID is MISSING from the database.' User wasn't found, so the page wasn't!
0 kommentar(er)
