[RootersCTF2019]babyWeb

  Discovery is an injection problem  

Tips in English The page has 18 strong passwords to protect

Disabled union sleep ' " or 

At first I thought if sql If the statement needs to be closed, then GG 了

First, enter a 1 have a look

  It is found that an sql sentence

Follow the old routine to see how many fields there are  

Discovery input to 3 The page will report an error , To 2 Normal echo , Therefore, it is clear that there are two fields

Use universal passwords +limit Take a look at the number of fields ,or It can be used || Instead of

1 || 1=1 limit 1

 

Find out flag Come out …… I don't know what I did