Record an edu, SQL injection practice

Catalog

0x01 Ideas ：inurl: exam result

0x02 Judgment injection

0x03 An error injection

0x04 sqlmap

---

0x01 Ideas ：inurl: exam result

( There is a high possibility of vulnerability ）

For probe rad Reptiles +jsfinder Crawl to the query interface post

This function has sql select sentence （ If the filtration is not rigorous, there is a greater possibility of injection ）

js front end ： ID number is checked at the front end 18 position Only by bypassing can you grab the bag

0x02 Judgment injection

Normal contracting

Single quotation marks synax Grammar mistakes

0x03 An error injection

0x04 sqlmap

Throw the rest directly to sqlmap Run inside