Shulou(Shulou.com)06/01 Report--

This article shows you how to achieve the blasting database name in Burpsuite, the content is concise and easy to understand, it can definitely brighten your eyes. I hope you can get something through the detailed introduction of this article.

Target environment: win7, phpstudy2018, sqli

First, judge the injection point

1. Normal access to the page

2. Add and1= 1 and and1=2 after id=1 to test, and find that the and1=2 return is abnormal, indicating that there is injection there.

192.168.1.129/sqli/Less-2/?id=1 and 1: 2

Second, construct payload

1. Database () gets the database name

2. Substring () intercepts the string, followed by three parameters, namely, the source string, the position of the intercept, and the number of digits intercepted

3. Substring (database (), 1Magne1) = 'ajar'. This statement means to intercept the first letter of the database name and determine whether it is equal to a. If you return a normal page, if you do not return an exception page

Http://192.168.1.129/sqli/Less-2/?id=1 and substring (database (), 1jue 1) = 'ajar #

3. Blasting with burpsuite

1. Open the burpsuite capture package and send it to the Intruder module, select Cluster Bomb mode, and add the parameters to be exploded.

2. Set the first parameter, assuming that the length of the database name is 10

3. Set the second parameter, assuming that the database name is 26 letters in lowercase

4. Start the attack. The first few packets returned are of different length, which is definitely the name of the database, arranged in order: security

Using similar methods, we can continue to burst out table names, field names and field modifications, mainly the construction of payload.

The above content is how to implement the blasting database name in Burpsuite. Have you learned the knowledge or skills? If you want to learn more skills or enrich your knowledge reserve, you are welcome to follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.