Shulou(Shulou.com)06/01 Report--

This article introduces you how to go around except the annotation character Get, the content is very detailed, interested friends can refer to, hope to be helpful to you.

Environment sqli-labs

Less 23

1. Input? id=1, normal operation

2. Enter special characters to report an error

3. Single quotation marks are closed, but it is found that #-+ and so on have been filtered.

4. Use the following code to close

192.168.1.121Universe sqliAccording to SqliAccording to SqliAccording to the fact that there is a problem in or'1.

5. Use union select to judge the number of fields

192.168.1.121 union select SqliCompact lesser than 23 words 1 'union select 1, 2, 3, 3, 1, 3, 1, 3, 1, 3, 1, 2, 3, 1, 2, 3, 1, 2, 3, 1, 2, 2, 3, 1, 2, 3, 1, 2, 2, 3, 1, 2, 3, 1, 2, 2, 3, 1, 2, 2, 3, 1, 2, 2, 3, 1, 2, 3, 1, 2, 3, 1, 2, 2, 3, 1, 2, 2, 3, 3, 1, 2, 3, 3, 1, 2, 3, 1, 2, 2, 3, 1, 2, 1, 2, 3, 1, 2, 1, 2, 2, 3, 1, 2, 3, 1, 2, 3, 1, 2,

6. Let id report an error, and union select will take effect

192.168.1.121 SqliCompact lesser or '1qlixxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

7. Get the database name

192.168.1.121 SqliAccording to 192.168.1.121 union select, 3 sqlippingsqlixxxxxxxxxxxx

On how to bypass except the comment character Get to share here, I hope the above content can be of some help to you, can learn more knowledge. If you think the article is good, you can share it for more people to see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.