buuctf
进入界面，先随便输入登录进去，常规sql注入
令他报错

发现是单引号包裹，字符型注入
接着就是老套路了
order by 查询 发现

到4的时候错误，所以有3个字段
联合查询 union select

可以发现2,3字段可以查询
试试查询2字段，发现2字段查询不了表名。。。。
然后查询3字段，发现了表名
表名如下：
{‘ALL_PLUGINS,APPLICABLE_ROLES,CHARACTER_SETS,CHECK_CONSTRAINTS,COLLATIONS,COLLATION_CHARACTER_SET_APPLICABILITY,COLUMNS,COLUMN_PRIVILEGES,ENABLED_ROLES,ENGINES,EVENTS,FILES,GLOBAL_STATUS,GLOBAL_VARIABLES,KEY_CACHES,KEY_COLUMN_USAGE,PARAMETERS,PARTITIONS,PLUGINS,PROCESSLIST,PROFILING,REFERENTIAL_CONSTRAINTS,ROUTINES,SCHEMATA,SCHEMA_PRIVILEGES,SESSION_STATUS,SESSION_VARIABLES,STATISTICS,SYSTEM_VARIABLES,TABLES,TABLESPACES,TABLE_CONSTRAINTS,TABLE_PRIVILEGES,TRIGGERS,USER_PRIVILEGES,VIEWS,GEOMETRY_COLUMNS,SPATIAL_REF_SYS,CLIENT_STATISTICS,INDEX_STATISTICS,INNODB_SYS_DATAFILES,USER_STATISTICS,INNODB_SYS_TABLESTATS,INNODB_LOCKS,INNODB_MUTEXES,INNODB_CMPMEM,INNODB_CMP_PER_INDEX,INNODB_CMP,INNODB_FT_DELETED,INNODB_CMP_RESET,INNODB_LOCK_WAITS,TABLE_STATISTICS,INNODB_TABLESPACES_ENCRYPTION,INNODB_BUFFER_PAGE_LRU,INNODB_SYS_FIELDS,INNODB_CMPMEM_RESET,INNODB_SYS_COLUMNS,INNODB_FT_INDEX_TABLE,INNODB_CMP_PER_INDEX_RESET,user_variables,INNODB_FT_INDEX_CACHE,INNODB_SYS_FOREIGN_COLS,INNODB_FT_BEING_DELETED,INNODB_BUFFER_POOL_STATS,INNODB_TRX,INNODB_SYS_FOREIGN,INNODB_SYS_TABLES,INNODB_FT_DEFAULT_STOPWORD,INNODB_FT_CONFIG,INNODB_BUFFER_PAGE,INNODB_SYS_TABLESPACES,INNODB_METRICS,INNODB_SYS_INDEXES,INNODB_SYS_VIRTUAL,INNODB_TABLESPACES_SCRUBBING,INNODB_SYS_SEMAPHORE_WAITS,accounts,cond_instances,events_stages_current,events_stages_history,events_stages_history_long,events_stages_summary_by_account_by_event_name,events_stages_summary_by_host_by_event_name,events_stages_summary_by_thread_by_event_name,events_stages_summary_by_user_by_event_name,events_stages_summary_global_by_event_name,events_statements_current,events_statements_history,events_statements_history_long,events_statements_summary_by_account_by_event_name,events_statements_summary_by_digest,events_statements_summary_by_host_by_event_name,events_statements_summary_by_thread_by_event_name,events_statements_summary_by_user_by_event_name,events_statements_summary_global_by_event_name,events_waits_current,events_waits_history,events_waits_history_long,events_waits_summary_by_account_by_event_name,events_waits_summary_by_host_by_event_name,events_waits_summary_by_instance,events_waits_summary_by_thread_by_event_name,events_waits_summary_by_user_by_event_name,events_waits_summary_global_by_event_name,file_instances,file_summary_by_event_name,file_summary_by_instance,host_cache,hosts,mutex_instances,objects_summary_global_by_type,performance_timers,rwlock_instances,session_account_connect_attrs,session_connect_attrs,setup_actors,setup_consumers,setup_instruments,setup_objects,setup_timers,socket_instances,socket_summary_by_event_name,socket_summary_by_instance,table_io_waits_summary_by_index_usage,table_io_waits_summary_by_table,table_lock_waits_summary_by_table,threads,users,column_stats,columns_priv,db,event,func,general_log,gtid_slave_pos,help_category,help_keyword,help_relation,help_topic,host,index_stats,innodb_index_stats,innodb_table_stats,plugin,proc,procs_priv,proxies_priv,roles_mapping,servers,slow_log,table_stats,tables_priv,time_zone,time_zone_leap_second,time_zone_name,time_zone_transition,time_zone_transition_type,transaction_registry,user,geekuser,l0ve1ysq1’}
一堆表名。。。。。

不慌不慌，再查询字段名
字段名如下
：{‘PLUGIN_NAME,PLUGIN_VERSION,PLUGIN_STATUS,PLUGIN_TYPE,PLUGIN_TYPE_VERSION,PLUGIN_LIBRARY,PLUGIN_LIBRARY_VERSION,PLUGIN_AUTHOR,PLUGIN_DESCRIPTION,PLUGIN_LICENSE,LOAD_OPTION,PLUGIN_MATURITY,PLUGIN_AUTH_VERSION,GRANTEE,ROLE_NAME,IS_GRANTABLE,IS_DEFAULT,CHARACTER_SET_NAME,DEFAULT_COLLATE_NAME,DESCRIPTION,MAXLEN,CONSTRAINT_CATALOG,CONSTRAINT_SCHEMA,CONSTRAINT_NAME,TABLE_NAME,CHECK_CLAUSE,COLLATION_NAME,CHARACTER_SET_NAME,ID,IS_DEFAULT,IS_COMPILED,SORTLEN,COLLATION_NAME,CHARACTER_SET_NAME,TABLE_CATALOG,TABLE_SCHEMA,TABLE_NAME,COLUMN_NAME,ORDINAL_POSITION,COLUMN_DEFAULT,IS_NULLABLE,DATA_TYPE,CHARACTER_MAXIMUM_LENGTH,CHARACTER_OCTET_LENGTH,NUMERIC_PRECISION,NUMERIC_SCALE,DATETIME_PRECISION,CHARACTER_SET_NAME,COLLATION_NAME,COLUMN_TYPE,COLUMN_KEY,EXTRA,PRIVILEGES,COLUMN_COMMENT,IS_GENERATED,GENERATION_EXPRESSION,GRANTEE,TABLE_CATALOG,TABLE_SCHEMA,TABLE_NAME,COLUMN_NAME,PRIVILEGE_TYPE,IS_GRANTABLE,ROLE_NAME,ENGINE,SUPPORT,COMMENT,TRANSACTIONS,XA,SAVEPOINTS,EVENT_CATALOG,EVENT_SCHEMA,EVENT_NAME,DEFINER,TIME_ZONE,EVENT_BODY,EVENT_DEFINITION,EVENT_TYPE,EXECUTE_AT,INTERVAL_VALUE,INTERVAL_FIELD,SQL_MODE,STARTS,ENDS,STATUS,ON_COMPLETION,CREATED,LAST_ALTERED,LAST_EXECUTED,EVENT_COMMENT,ORIGINATOR,CHARACTER_SET_CLIENT,COLLATION_CONNECTION,DATABASE_COLLATION,FILE_ID,FILE_NAME,FILE_TYPE,TABLESPACE_NAME,TABLE_CATALOG,TABLE_SCHEMA,TABLE_NAME,LOGFILE_GROUP_NAME,LOGFILE_GROUP_NUMBER,ENGINE,FULLTEXT_KEYS,DELETED_ROWS,UPDATE_COUNT,FREE_EXTENTS,TOTAL_EXTENTS,EXTENT_SIZE,INITIAL_SIZE,MAXIMUM_SIZE,AUTOEXTEND_SIZE,CREATION_TIME,LAST_UPDATE_TIME,LAST_ACCESS_TIME,RECOVER_TIME,TRANSACTION_COUNTER,VERSION,ROW_FORMAT,TABLE_ROWS,AVG_ROW_LENGTH,DATA_LENGTH,MAX_DATA_LENGTH,INDEX_LENGTH,DATA_FREE,CREATE_TIME,UPDATE_TIME,CHECK_TIME,CHECKSUM,STATUS,EXTRA,VARIABLE_NAME,VARIABLE_VALUE,VARIABLE_NAME,VARIABLE_VALUE,KEY_CACHE_NAME,SEGMENTS,SEGMENT_NUMBER,FULL_SIZE,BLOCK_SIZE,USED_BLOCKS,UNUSED_BLOCKS,DIRTY_BLOCKS,READ_REQUESTS,READS,WRITE_REQUESTS,WRITES,CONSTRAINT_CATALOG,CONSTRAINT_SCHEMA,CONSTRAINT_NAME,TABLE_CATALOG,TABLE_SCHEMA,TABLE_NAME,COLUMN_NAME,ORDINAL_POSITION,POSITION_IN_UNIQUE_CONSTRAINT,REFERENCED_TABLE_SCHEMA,REFERENCED_TABLE_NAME,REFERENCED_COLUMN_NAME,SPECIFIC_CATALOG,SPECIFIC_SCHEMA,SPECIFIC_NAME,ORDINAL_POSITION,PARAMETER_MODE,PARAMETER_NAME,DATA_TYPE,CHARACTER_MAXIMUM_LENGTH,CHARACTER_OCTET_LENGTH,NUMERIC_PRECISION,NUMERIC_SCALE,DATETIME_PRECISION,CHARACTER_SET_NAME,COLLATION_NAME,DTD_IDENTIFIER,ROUTINE_TYPE,TABLE_CATALOG,TABLE_SCHEMA,TABLE_NAME,PARTITION_NAME,SUBPARTITION_NAME,PARTITION_ORDINAL_POSITION,SUBPARTITION_ORDINAL_POSITION,PARTITION_METHOD,SUBPARTITION_METHOD,PARTITION_EXPRESSION,SUBPARTITION_EXPRESSION,PARTITION_DESCRIPTION,TABLE_ROWS,AVG_ROW_LENGTH,DATA_LENGTH,MAX_DATA_LENGTH,INDEX_LENGTH,DATA_FREE,CREATE_TIME,UPDATE_TIME,CHECK_TIME,CHECKSUM,PARTITION_COMMENT,NODEGROUP,TABLESPACE_NAME,PLUGIN_NAME,PLUGIN_VERSION,PLUGIN_STATUS,PLUGIN_TYPE,PLUGIN_TYPE_VERSION,PLUGIN_LIBRARY,PLUGIN_LIBRARY_VERSION,PLUGIN_AUTHOR,PLUGIN_DESCRIPTION,PLUGIN_LICENSE,LOAD_OPTION,PLUGIN_MATURITY,PLUGIN_AUTH_VERSION,ID,USER,HOST,DB,COMMAND,TIME,STATE,INFO,TIME_MS,STAGE,MAX_STAGE,PROGRESS,MEMORY_USED,MAX_MEMORY_USED,EXAMINED_ROWS,QUERY_ID,INFO_BINARY,TID,QUERY_ID,SEQ,STATE,DURATION,CPU_USER,CPU_SYSTEM,CONTEXT_VOLUNTARY,CONTEXT_INVOLUNTARY,BLOCK_OPS_IN,BLOCK_OPS_OUT,MESSAGES_SENT,MESSAGES_RECEIVED,PAGE_FAULTS_MAJOR,PAGE_FAULTS_MINOR,SWAPS,SOURCE_FUNCTION,SOURCE_FILE,SOURCE_LINE,CONSTRAINT_CATALOG,CONSTRAINT_SCHEMA,CONSTRAINT_NAME,UNIQUE_CONSTRAINT_CATALOG,UNIQUE_CONSTRAINT_SCHEMA,UNIQUE_CONSTRAINT_NAME,MATCH_OPTION,UPDATE_RULE,DELETE_RULE,TABLE_NAME,REFERENCED_TABLE_NAME,SPECIFIC_NAME,ROUTINE_CATALOG,ROUTINE_SCHEMA,ROUTINE_NAME,ROUTINE_TYPE,DATA_TYPE,CHARACTER_MAXIMUM_LENGTH,CHARACTER_OCTET_LENGTH,NUMERIC_PRECISION,NUMERIC_SCALE,DATETIME_PRECISION,CHARACTER_SET_NAME,COLLATION_NAME,DTD_IDENTIFIER,ROUTINE_BODY,ROUTINE_DEFINITION,EXTERNAL_NAME,EXTERNAL_LANGUAGE,PARAMETER_STYLE,IS_DETERMINISTIC,SQL_DATA_ACCESS,SQL_PATH,SECURITY_TYPE,CREATED,LAST_ALTERED,SQL_MODE,ROUTINE_COMMENT,DEFINER,CHARACTER_SET_CLIENT,COLLATION_CONNECTION,DATABASE_COLLATION,CATALOG_NAME,SCHEMA_NAME,DEFAULT_CHARACTER_SET_NAME,DEFAULT_COLLATION_NAME,SQL_PATH,GRANTEE,TABLE_CATALOG,TABLE_SCHEMA,PRIVILEGE_TYPE,IS_GRANTABLE,VARIABLE_NAME,VARIABLE_VALUE,VARIABLE_NAME,VARIABLE_VALUE,TABLE_CATALOG,TABLE_SCHEMA,TABLE_NAME,NON_UNIQUE,INDEX_SCHEMA,INDEX_NAME,SEQ_IN_INDEX,COLUMN_NAME,COLLATION,CARDINALITY,SUB_PART,PACKED,NULLABLE,INDEX_TYPE,COMMENT,INDEX_COMMENT,VARIABLE_NAME,SESSION_VALUE,GLOBAL_VALUE,GLOBAL_VALUE_ORIGIN,DEFAULT_VALUE,VARIABLE_SCOPE,VARIABLE_TYPE,VARIABLE_COMMENT,NUMERIC_MIN_VALUE,NUMERIC_MAX_VALUE,NUMERIC_BLOCK_SIZE,ENUM_VALUE_LIST,READ_ONLY,COMMAND_LINE_ARGUMENT,TABLE_CATALOG,TABLE_SCHEMA,TABLE_NAME,TABLE_TYPE,ENGINE,VERSION,ROW_FORMAT,TABLE_ROWS,AVG_ROW_LENGTH,DATA_LENGTH,MAX_DATA_LENGTH,INDEX_LENGTH,DATA_FREE,AUTO_INCREMENT,CREATE_TIME,UPDATE_TIME,CHECK_TIME,TABLE_COLLATION,CHECKSUM,CREATE_OPTIONS,TABLE_COMMENT,MAX_INDEX_LENGTH,TEMPORARY,TABLESPACE_NAME,ENGINE,TABLESPACE_TYPE,LOGFILE_GROUP_NAME,EXTENT_SIZE,AUTOEXTEND_SIZE,MAXIMUM_SIZE,NODEGROUP_ID,TABLESPACE_COMMENT,CONSTRAINT_CATALOG,CONSTRAINT_SCHEMA,CONSTRAINT_NAME,TABLE_SCHEMA,TABLE_NAME,CONSTRAINT_TYPE,GRANTEE,TABLE_CATALOG,TABLE_SCHEMA,TABLE_NAME,PRIVILEGE_TYPE,IS_GRANTABLE,TRIGGER_CATALOG,TRIGGER_SCHEMA,TRIGGER_NAME,EVENT_MANIPULATION,EVENT_OBJECT_CATALOG,EVENT_OBJECT_SCHEMA,EVENT_OBJECT_TABLE,ACTION_ORDER,ACTION_CONDITION,ACTION_STATEMENT,ACTION_ORIENTATION,ACTION_TIMING,ACTION_REFERENCE_OLD_TABLE,ACTION_REFERENCE_NEW_TABLE,ACTION_REFERENCE_OLD_ROW,ACTION_REFERENCE_NEW_ROW,CREATED,SQL_MODE,DEFINER,CHARACTER_SET_CLIENT,COLLATION_CONNECTION,DATABASE_COLLATION,GRANTEE,TABLE_CATALOG,PRIVILEGE_TYPE,IS_GRANTABLE,TABLE_CATALOG,TABLE_SCHEMA,TABLE_NAME,VIEW_DEFINITION,CHECK_OPTION,IS_UPDATABLE,DEFINER,SECURITY_TYPE,CHARACTER_SET_CLIENT,COLLATION_CONNECTION,ALGORITHM,F_TABLE_CATALOG,F_TABLE_SCHEMA,F_TABLE_NAME,F_GEOMETRY_COLUMN,G_TABLE_CATALOG,G_TABLE_SCHEMA,G_TABLE_NAME,G_GEOMETRY_COLUMN,STORAGE_TYPE,GEOMETRY_TYPE,COORD_DIMENSION,MAX_PPR,SRID,SRID,AUTH_NAME,AUTH_SRID,SRTEXT,CLIENT,TOTAL_CONNECTIONS,CONCURRENT_CONNECTIONS,CONNECTED_TIME,BUSY_TIME,CPU_TIME,BYTES_RECEIVED,BYTES_SENT,BINLOG_BYTES_WRITTEN,ROWS_READ,ROWS_SENT,ROWS_DELETED,ROWS_INSERTED,ROWS_UPDATED,SELECT_COMMANDS,UPDATE_COMMANDS,OTHER_COMMANDS,COMMIT_TRANSACTIONS,ROLLBACK_TRANSACTIONS,DENIED_CONNECTIONS,LOST_CONNECTIONS,ACCESS_DENIED,EMPTY_QUERIES,TOTAL_SSL_CONNECTIONS,MAX_STATEMENT_TIME_EXCEEDED,TABLE_SCHEMA,TABLE_NAME,INDEX_NAME,ROWS_READ,SPACE,PATH,USER,TOTAL_CONNECTIONS,CONCURRENT_CONNECTIONS,CONNECTED_TIME,BUSY_TIME,CPU_TIME,BYTES_RECEIVED,BYTES_SENT,BINLOG_BYTES_WRITTEN,ROWS_READ,ROWS_SENT,ROWS_DELETED,ROWS_INSERTED,ROWS_UPDATED,SELECT_COMMANDS,UPDATE_COMMANDS,OTHER_COMMANDS,COMMIT_TRANSACTIONS,ROLLBACK_TRANSACTIONS,DENIED_CONNECTIONS,LOST_CONNECTIONS,ACCESS_DENIED,EMPTY_QUERIES,TOTAL_SSL_CONNECTIONS,MAX_STATEMENT_TIME_EXCEEDED,TABLE_ID,NAME,STATS_INITIALIZED,NUM_ROWS,CLUST_INDEX_SIZE,OTHER_INDEX_SIZE,MODIFIED_COUNTER,AUTOINC,REF_COUNT,lock_id,lock_trx_id,lock_mode,lock_type,lock_table,lock_index,lock_space,lock_page,lock_rec,lock_data,NAME,CREATE_FILE,CREATE_LINE,OS_WAITS,page_size,buffer_pool_instance,pages_used,pages_free,relocation_ops,relocation_time,database_name,table_name,index_name,compress_ops,compress_ops_ok,compress_time,uncompress_ops,uncompress_time,page_size,compress_ops,compress_ops_ok,compress_time,uncompress_ops,uncompress_time,DOC_ID,page_size,compress_ops,compress_ops_ok,compress_time,uncompress_ops,uncompress_time,requesting_trx_id,requested_lock_id,blocking_trx_id,blocking_lock_id,TABLE_SCHEMA,TABLE_NAME,ROWS_READ,ROWS_CHANGED,ROWS_CHANGED_X_INDEXES,SPACE,NAME,ENCRYPTION_SCHEME,KEYSERVER_REQUESTS,MIN_KEY_VERSION,CURRENT_KEY_VERSION,KEY_ROTATION_PAGE_NUMBER,KEY_ROTATION_MAX_PAGE_NUMBER,CURRENT_KEY_ID,ROTATING_OR_FLUSHING,POOL_ID,LRU_POSITION,SPACE,PAGE_NUMBER,PAGE_TYPE,FLUSH_TYPE,FIX_COUNT,IS_HASHED,NEWEST_MODIFICATION,OLDEST_MODIFICATION,ACCESS_TIME,TABLE_NAME,INDEX_NAME,NUMBER_RECORDS,DATA_SIZE,COMPRESSED_SIZE,COMPRESSED,IO_FIX,IS_OLD,FREE_PAGE_CLOCK,INDEX_ID,NAME,POS,page_size,buffer_pool_instance,pages_used,pages_free,relocation_ops,relocation_time,TABLE_ID,NAME,POS,MTYPE,PRTYPE,LEN,WORD,FIRST_DOC_ID,LAST_DOC_ID,DOC_COUNT,DOC_ID,POSITION,database_name,table_name,index_name,compress_ops,compress_ops_ok,compress_time,uncompress_ops,uncompress_time,VARIABLE_NAME,VARIABLE_VALUE,VARIABLE_TYPE,CHARACTER_SET_NAME,WORD,FIRST_DOC_ID,LAST_DOC_ID,DOC_COUNT,DOC_ID,POSITION,ID,FOR_COL_NAME,REF_COL_NAME,POS,DOC_ID,POOL_ID,POOL_SIZE,FREE_BUFFERS,DATABASE_PAGES,OLD_DATABASE_PAGES,MODIFIED_DATABASE_PAGES,PENDING_DECOMPRESS,PENDING_READS,PENDING_FLUSH_LRU,PENDING_FLUSH_LIST,PAGES_MADE_YOUNG,PAGES_NOT_MADE_YOUNG,PAGES_MADE_YOUNG_RATE,PAGES_MADE_NOT_YOUNG_RATE,NUMBER_PAGES_READ,NUMBER_PAGES_CREATED,NUMBER_PAGES_WRITTEN,PAGES_READ_RATE,PAGES_CREATE_RATE,PAGES_WRITTEN_RATE,NUMBER_PAGES_GET,HIT_RATE,YOUNG_MAKE_PER_THOUSAND_GETS,NOT_YOUNG_MAKE_PER_THOUSAND_GETS,NUMBER_PAGES_READ_AHEAD,NUMBER_READ_AHEAD_EVICTED,READ_AHEAD_RATE,READ_AHEAD_EVICTED_RATE,LRU_IO_TOTAL,LRU_IO_CURRENT,UNCOMPRESS_TOTAL,UNCOMPRESS_CURRENT,trx_id,trx_state,trx_started,trx_requested_lock_id,trx_wait_started,trx_weight,trx_mysql_thread_id,trx_query,trx_operation_state,trx_tables_in_use,trx_tables_locked,trx_lock_structs,trx_lock_memory_bytes,trx_rows_locked,trx_rows_modified,trx_concurrency_tickets,trx_isolation_level,trx_unique_checks,trx_foreign_key_checks,trx_last_foreign_key_error,trx_is_read_only,trx_autocommit_non_locking,ID,FOR_NAME,REF_NAME,N_COLS,TYPE,TABLE_ID,NAME,FLAG,N_COLS,SPACE,ROW_FORMAT,ZIP_PAGE_SIZE,SPACE_TYPE,value,KEY,VALUE,POOL_ID,BLOCK_ID,SPACE,PAGE_NUMBER,PAGE_TYPE,FLUSH_TYPE,FIX_COUNT,IS_HASHED,NEWEST_MODIFICATION,OLDEST_MODIFICATION,ACCESS_TIME,TABLE_NAME,INDEX_NAME,NUMBER_RECORDS,DATA_SIZE,COMPRESSED_SIZE,PAGE_STATE,IO_FIX,IS_OLD,FREE_PAGE_CLOCK,SPACE,NAME,FLAG,ROW_FORMAT,PAGE_SIZE,ZIP_PAGE_SIZE,SPACE_TYPE,FS_BLOCK_SIZE,FILE_SIZE,ALLOCATED_SIZE,NAME,SUBSYSTEM,COUNT,MAX_COUNT,MIN_COUNT,AVG_COUNT,COUNT_RESET,MAX_COUNT_RESET,MIN_COUNT_RESET,AVG_COUNT_RESET,TIME_ENABLED,TIME_DISABLED,TIME_ELAPSED,TIME_RESET,STATUS,TYPE,COMMENT,INDEX_ID,NAME,TABLE_ID,TYPE,N_FIELDS,PAGE_NO,SPACE,MERGE_THRESHOLD,TABLE_ID,POS,BASE_POS,SPACE,NAME,COMPRESSED,LAST_SCRUB_COMPLETED,CURRENT_SCRUB_STARTED,CURRENT_SCRUB_ACTIVE_THREADS,CURRENT_SCRUB_PAGE_NUMBER,CURRENT_SCRUB_MAX_PAGE_NUMBER,THREAD_ID,OBJECT_NAME,FILE,LINE,WAIT_TIME,WAIT_OBJECT,WAIT_TYPE,HOLDER_THREAD_ID,HOLDER_FILE,HOLDER_LINE,CREATED_FILE,CREATED_LINE,WRITER_THREAD,RESERVATION_MODE,READERS,WAITERS_FLAG,LOCK_WORD,LAST_WRITER_FILE,LAST_WRITER_LINE,OS_WAIT_COUNT,USER,HOST,CURRENT_CONNECTIONS,TOTAL_CONNECTIONS,NAME,OBJECT_INSTANCE_BEGIN,THREAD_ID,EVENT_ID,END_EVENT_ID,EVENT_NAME,SOURCE,TIMER_START,TIMER_END,TIMER_WAIT,NESTING_EVENT_ID,NESTING_EVENT_TYPE,THREAD_ID,EVENT_ID,END_EVENT_ID,EVENT_NAME,SOURCE,TIMER_START,TIMER_END,TIMER_WAIT,NESTING_EVENT_ID,NESTING_EVENT_TYPE,THREAD_ID,EVENT_ID,END_EVENT_ID,EVENT_NAME,SOURCE,TIMER_START,TIMER_END,TIMER_WAIT,NESTING_EVENT_ID,NESTING_EVENT_TYPE,USER,HOST,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,HOST,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,THREAD_ID,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,USER,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,THREAD_ID,EVENT_ID,END_EVENT_ID,EVENT_NAME,SOURCE,TIMER_START,TIMER_END,TIMER_WAIT,LOCK_TIME,SQL_TEXT,DIGEST,DIGEST_TEXT,CURRENT_SCHEMA,OBJECT_TYPE,OBJECT_SCHEMA,OBJECT_NAME,OBJECT_INSTANCE_BEGIN,MYSQL_ERRNO,RETURNED_SQLSTATE,MESSAGE_TEXT,ERRORS,WARNINGS,ROWS_AFFECTED,ROWS_SENT,ROWS_EXAMINED,CREATED_TMP_DISK_TABLES,CREATED_TMP_TABLES,SELECT_FULL_JOIN,SELECT_FULL_RANGE_JOIN,SELECT_RANGE,SELECT_RANGE_CHECK,SELECT_SCAN,SORT_MERGE_PASSES,SORT_RANGE,SORT_ROWS,SORT_SCAN,NO_INDEX_USED,NO_GOOD_INDEX_USED,NESTING_EVENT_ID,NESTING_EVENT_TYPE,THREAD_ID,EVENT_ID,END_EVENT_ID,EVENT_NAME,SOURCE,TIMER_START,TIMER_END,TIMER_WAIT,LOCK_TIME,SQL_TEXT,DIGEST,DIGEST_TEXT,CURRENT_SCHEMA,OBJECT_TYPE,OBJECT_SCHEMA,OBJECT_NAME,OBJECT_INSTANCE_BEGIN,MYSQL_ERRNO,RETURNED_SQLSTATE,MESSAGE_TEXT,ERRORS,WARNINGS,ROWS_AFFECTED,ROWS_SENT,ROWS_EXAMINED,CREATED_TMP_DISK_TABLES,CREATED_TMP_TABLES,SELECT_FULL_JOIN,SELECT_FULL_RANGE_JOIN,SELECT_RANGE,SELECT_RANGE_CHECK,SELECT_SCAN,SORT_MERGE_PASSES,SORT_RANGE,SORT_ROWS,SORT_SCAN,NO_INDEX_USED,NO_GOOD_INDEX_USED,NESTING_EVENT_ID,NESTING_EVENT_TYPE,THREAD_ID,EVENT_ID,END_EVENT_ID,EVENT_NAME,SOURCE,TIMER_START,TIMER_END,TIMER_WAIT,LOCK_TIME,SQL_TEXT,DIGEST,DIGEST_TEXT,CURRENT_SCHEMA,OBJECT_TYPE,OBJECT_SCHEMA,OBJECT_NAME,OBJECT_INSTANCE_BEGIN,MYSQL_ERRNO,RETURNED_SQLSTATE,MESSAGE_TEXT,ERRORS,WARNINGS,ROWS_AFFECTED,ROWS_SENT,ROWS_EXAMINED,CREATED_TMP_DISK_TABLES,CREATED_TMP_TABLES,SELECT_FULL_JOIN,SELECT_FULL_RANGE_JOIN,SELECT_RANGE,SELECT_RANGE_CHECK,SELECT_SCAN,SORT_MERGE_PASSES,SORT_RANGE,SORT_ROWS,SORT_SCAN,NO_INDEX_USED,NO_GOOD_INDEX_USED,NESTING_EVENT_ID,NESTING_EVENT_TYPE,USER,HOST,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,SUM_LOCK_TIME,SUM_ERRORS,SUM_WARNINGS,SUM_ROWS_AFFECTED,SUM_ROWS_SENT,SUM_ROWS_EXAMINED,SUM_CREATED_TMP_DISK_TABLES,SUM_CREATED_TMP_TABLES,SUM_SELECT_FULL_JOIN,SUM_SELECT_FULL_RANGE_JOIN,SUM_SELECT_RANGE,SUM_SELECT_RANGE_CHECK,SUM_SELECT_SCAN,SUM_SORT_MERGE_PASSES,SUM_SORT_RANGE,SUM_SORT_ROWS,SUM_SORT_SCAN,SUM_NO_INDEX_USED,SUM_NO_GOOD_INDEX_USED,SCHEMA_NAME,DIGEST,DIGEST_TEXT,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,SUM_LOCK_TIME,SUM_ERRORS,SUM_WARNINGS,SUM_ROWS_AFFECTED,SUM_ROWS_SENT,SUM_ROWS_EXAMINED,SUM_CREATED_TMP_DISK_TABLES,SUM_CREATED_TMP_TABLES,SUM_SELECT_FULL_JOIN,SUM_SELECT_FULL_RANGE_JOIN,SUM_SELECT_RANGE,SUM_SELECT_RANGE_CHECK,SUM_SELECT_SCAN,SUM_SORT_MERGE_PASSES,SUM_SORT_RANGE,SUM_SORT_ROWS,SUM_SORT_SCAN,SUM_NO_INDEX_USED,SUM_NO_GOOD_INDEX_USED,FIRST_SEEN,LAST_SEEN,HOST,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,SUM_LOCK_TIME,SUM_ERRORS,SUM_WARNINGS,SUM_ROWS_AFFECTED,SUM_ROWS_SENT,SUM_ROWS_EXAMINED,SUM_CREATED_TMP_DISK_TABLES,SUM_CREATED_TMP_TABLES,SUM_SELECT_FULL_JOIN,SUM_SELECT_FULL_RANGE_JOIN,SUM_SELECT_RANGE,SUM_SELECT_RANGE_CHECK,SUM_SELECT_SCAN,SUM_SORT_MERGE_PASSES,SUM_SORT_RANGE,SUM_SORT_ROWS,SUM_SORT_SCAN,SUM_NO_INDEX_USED,SUM_NO_GOOD_INDEX_USED,THREAD_ID,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,SUM_LOCK_TIME,SUM_ERRORS,SUM_WARNINGS,SUM_ROWS_AFFECTED,SUM_ROWS_SENT,SUM_ROWS_EXAMINED,SUM_CREATED_TMP_DISK_TABLES,SUM_CREATED_TMP_TABLES,SUM_SELECT_FULL_JOIN,SUM_SELECT_FULL_RANGE_JOIN,SUM_SELECT_RANGE,SUM_SELECT_RANGE_CHECK,SUM_SELECT_SCAN,SUM_SORT_MERGE_PASSES,SUM_SORT_RANGE,SUM_SORT_ROWS,SUM_SORT_SCAN,SUM_NO_INDEX_USED,SUM_NO_GOOD_INDEX_USED,USER,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,SUM_LOCK_TIME,SUM_ERRORS,SUM_WARNINGS,SUM_ROWS_AFFECTED,SUM_ROWS_SENT,SUM_ROWS_EXAMINED,SUM_CREATED_TMP_DISK_TABLES,SUM_CREATED_TMP_TABLES,SUM_SELECT_FULL_JOIN,SUM_SELECT_FULL_RANGE_JOIN,SUM_SELECT_RANGE,SUM_SELECT_RANGE_CHECK,SUM_SELECT_SCAN,SUM_SORT_MERGE_PASSES,SUM_SORT_RANGE,SUM_SORT_ROWS,SUM_SORT_SCAN,SUM_NO_INDEX_USED,SUM_NO_GOOD_INDEX_USED,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,SUM_LOCK_TIME,SUM_ERRORS,SUM_WARNINGS,SUM_ROWS_AFFECTED,SUM_ROWS_SENT,SUM_ROWS_EXAMINED,SUM_CREATED_TMP_DISK_TABLES,SUM_CREATED_TMP_TABLES,SUM_SELECT_FULL_JOIN,SUM_SELECT_FULL_RANGE_JOIN,SUM_SELECT_RANGE,SUM_SELECT_RANGE_CHECK,SUM_SELECT_SCAN,SUM_SORT_MERGE_PASSES,SUM_SORT_RANGE,SUM_SORT_ROWS,SUM_SORT_SCAN,SUM_NO_INDEX_USED,SUM_NO_GOOD_INDEX_USED,THREAD_ID,EVENT_ID,END_EVENT_ID,EVENT_NAME,SOURCE,TIMER_START,TIMER_END,TIMER_WAIT,SPINS,OBJECT_SCHEMA,OBJECT_NAME,INDEX_NAME,OBJECT_TYPE,OBJECT_INSTANCE_BEGIN,NESTING_EVENT_ID,NESTING_EVENT_TYPE,OPERATION,NUMBER_OF_BYTES,FLAGS,THREAD_ID,EVENT_ID,END_EVENT_ID,EVENT_NAME,SOURCE,TIMER_START,TIMER_END,TIMER_WAIT,SPINS,OBJECT_SCHEMA,OBJECT_NAME,INDEX_NAME,OBJECT_TYPE,OBJECT_INSTANCE_BEGIN,NESTING_EVENT_ID,NESTING_EVENT_TYPE,OPERATION,NUMBER_OF_BYTES,FLAGS,THREAD_ID,EVENT_ID,END_EVENT_ID,EVENT_NAME,SOURCE,TIMER_START,TIMER_END,TIMER_WAIT,SPINS,OBJECT_SCHEMA,OBJECT_NAME,INDEX_NAME,OBJECT_TYPE,OBJECT_INSTANCE_BEGIN,NESTING_EVENT_ID,NESTING_EVENT_TYPE,OPERATION,NUMBER_OF_BYTES,FLAGS,USER,HOST,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,HOST,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,EVENT_NAME,OBJECT_INSTANCE_BEGIN,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,THREAD_ID,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,USER,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,FILE_NAME,EVENT_NAME,OPEN_COUNT,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,COUNT_READ,SUM_TIMER_READ,MIN_TIMER_READ,AVG_TIMER_READ,MAX_TIMER_READ,SUM_NUMBER_OF_BYTES_READ,COUNT_WRITE,SUM_TIMER_WRITE,MIN_TIMER_WRITE,AVG_TIMER_WRITE,MAX_TIMER_WRITE,SUM_NUMBER_OF_BYTES_WRITE,COUNT_MISC,SUM_TIMER_MISC,MIN_TIMER_MISC,AVG_TIMER_MISC,MAX_TIMER_MISC,FILE_NAME,EVENT_NAME,OBJECT_INSTANCE_BEGIN,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,COUNT_READ,SUM_TIMER_READ,MIN_TIMER_READ,AVG_TIMER_READ,MAX_TIMER_READ,SUM_NUMBER_OF_BYTES_READ,COUNT_WRITE,SUM_TIMER_WRITE,MIN_TIMER_WRITE,AVG_TIMER_WRITE,MAX_TIMER_WRITE,SUM_NUMBER_OF_BYTES_WRITE,COUNT_MISC,SUM_TIMER_MISC,MIN_TIMER_MISC,AVG_TIMER_MISC,MAX_TIMER_MISC,IP,HOST,HOST_VALIDATED,SUM_CONNECT_ERRORS,COUNT_HOST_BLOCKED_ERRORS,COUNT_NAMEINFO_TRANSIENT_ERRORS,COUNT_NAMEINFO_PERMANENT_ERRORS,COUNT_FORMAT_ERRORS,COUNT_ADDRINFO_TRANSIENT_ERRORS,COUNT_ADDRINFO_PERMANENT_ERRORS,COUNT_FCRDNS_ERRORS,COUNT_HOST_ACL_ERRORS,COUNT_NO_AUTH_PLUGIN_ERRORS,COUNT_AUTH_PLUGIN_ERRORS,COUNT_HANDSHAKE_ERRORS,COUNT_PROXY_USER_ERRORS,COUNT_PROXY_USER_ACL_ERRORS,COUNT_AUTHENTICATION_ERRORS,COUNT_SSL_ERRORS,COUNT_MAX_USER_CONNECTIONS_ERRORS,COUNT_MAX_USER_CONNECTIONS_PER_HOUR_ERRORS,COUNT_DEFAULT_DATABASE_ERRORS,COUNT_INIT_CONNECT_ERRORS,COUNT_LOCAL_ERRORS,COUNT_UNKNOWN_ERRORS,FIRST_SEEN,LAST_SEEN,FIRST_ERROR_SEEN,LAST_ERROR_SEEN,HOST,CURRENT_CONNECTIONS,TOTAL_CONNECTIONS,NAME,OBJECT_INSTANCE_BEGIN,LOCKED_BY_THREAD_ID,OBJECT_TYPE,OBJECT_SCHEMA,OBJECT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,TIMER_NAME,TIMER_FREQUENCY,TIMER_RESOLUTION,TIMER_OVERHEAD,NAME,OBJECT_INSTANCE_BEGIN,WRITE_LOCKED_BY_THREAD_ID,READ_LOCKED_BY_COUNT,PROCESSLIST_ID,ATTR_NAME,ATTR_VALUE,ORDINAL_POSITION,PROCESSLIST_ID,ATTR_NAME,ATTR_VALUE,ORDINAL_POSITION,HOST,USER,ROLE,NAME,ENABLED,NAME,ENABLED,TIMED,OBJECT_TYPE,OBJECT_SCHEMA,OBJECT_NAME,ENABLED,TIMED,NAME,TIMER_NAME,EVENT_NAME,OBJECT_INSTANCE_BEGIN,THREAD_ID,SOCKET_ID,IP,PORT,STATE,EVENT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,COUNT_READ,SUM_TIMER_READ,MIN_TIMER_READ,AVG_TIMER_READ,MAX_TIMER_READ,SUM_NUMBER_OF_BYTES_READ,COUNT_WRITE,SUM_TIMER_WRITE,MIN_TIMER_WRITE,AVG_TIMER_WRITE,MAX_TIMER_WRITE,SUM_NUMBER_OF_BYTES_WRITE,COUNT_MISC,SUM_TIMER_MISC,MIN_TIMER_MISC,AVG_TIMER_MISC,MAX_TIMER_MISC,EVENT_NAME,OBJECT_INSTANCE_BEGIN,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,COUNT_READ,SUM_TIMER_READ,MIN_TIMER_READ,AVG_TIMER_READ,MAX_TIMER_READ,SUM_NUMBER_OF_BYTES_READ,COUNT_WRITE,SUM_TIMER_WRITE,MIN_TIMER_WRITE,AVG_TIMER_WRITE,MAX_TIMER_WRITE,SUM_NUMBER_OF_BYTES_WRITE,COUNT_MISC,SUM_TIMER_MISC,MIN_TIMER_MISC,AVG_TIMER_MISC,MAX_TIMER_MISC,OBJECT_TYPE,OBJECT_SCHEMA,OBJECT_NAME,INDEX_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,COUNT_READ,SUM_TIMER_READ,MIN_TIMER_READ,AVG_TIMER_READ,MAX_TIMER_READ,COUNT_WRITE,SUM_TIMER_WRITE,MIN_TIMER_WRITE,AVG_TIMER_WRITE,MAX_TIMER_WRITE,COUNT_FETCH,SUM_TIMER_FETCH,MIN_TIMER_FETCH,AVG_TIMER_FETCH,MAX_TIMER_FETCH,COUNT_INSERT,SUM_TIMER_INSERT,MIN_TIMER_INSERT,AVG_TIMER_INSERT,MAX_TIMER_INSERT,COUNT_UPDATE,SUM_TIMER_UPDATE,MIN_TIMER_UPDATE,AVG_TIMER_UPDATE,MAX_TIMER_UPDATE,COUNT_DELETE,SUM_TIMER_DELETE,MIN_TIMER_DELETE,AVG_TIMER_DELETE,MAX_TIMER_DELETE,OBJECT_TYPE,OBJECT_SCHEMA,OBJECT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,COUNT_READ,SUM_TIMER_READ,MIN_TIMER_READ,AVG_TIMER_READ,MAX_TIMER_READ,COUNT_WRITE,SUM_TIMER_WRITE,MIN_TIMER_WRITE,AVG_TIMER_WRITE,MAX_TIMER_WRITE,COUNT_FETCH,SUM_TIMER_FETCH,MIN_TIMER_FETCH,AVG_TIMER_FETCH,MAX_TIMER_FETCH,COUNT_INSERT,SUM_TIMER_INSERT,MIN_TIMER_INSERT,AVG_TIMER_INSERT,MAX_TIMER_INSERT,COUNT_UPDATE,SUM_TIMER_UPDATE,MIN_TIMER_UPDATE,AVG_TIMER_UPDATE,MAX_TIMER_UPDATE,COUNT_DELETE,SUM_TIMER_DELETE,MIN_TIMER_DELETE,AVG_TIMER_DELETE,MAX_TIMER_DELETE,OBJECT_TYPE,OBJECT_SCHEMA,OBJECT_NAME,COUNT_STAR,SUM_TIMER_WAIT,MIN_TIMER_WAIT,AVG_TIMER_WAIT,MAX_TIMER_WAIT,COUNT_READ,SUM_TIMER_READ,MIN_TIMER_READ,AVG_TIMER_READ,MAX_TIMER_READ,COUNT_WRITE,SUM_TIMER_WRITE,MIN_TIMER_WRITE,AVG_TIMER_WRITE,MAX_TIMER_WRITE,COUNT_READ_NORMAL,SUM_TIMER_READ_NORMAL,MIN_TIMER_READ_NORMAL,AVG_TIMER_READ_NORMAL,MAX_TIMER_READ_NORMAL,COUNT_READ_WITH_SHARED_LOCKS,SUM_TIMER_READ_WITH_SHARED_LOCKS,MIN_TIMER_READ_WITH_SHARED_LOCKS,AVG_TIMER_READ_WITH_SHARED_LOCKS,MAX_TIMER_READ_WITH_SHARED_LOCKS,COUNT_READ_HIGH_PRIORITY,SUM_TIMER_READ_HIGH_PRIORITY,MIN_TIMER_READ_HIGH_PRIORITY,AVG_TIMER_READ_HIGH_PRIORITY,MAX_TIMER_READ_HIGH_PRIORITY,COUNT_READ_NO_INSERT,SUM_TIMER_READ_NO_INSERT,MIN_TIMER_READ_NO_INSERT,AVG_TIMER_READ_NO_INSERT,MAX_TIMER_READ_NO_INSERT,COUNT_READ_EXTERNAL,SUM_TIMER_READ_EXTERNAL,MIN_TIMER_READ_EXTERNAL,AVG_TIMER_READ_EXTERNAL,MAX_TIMER_READ_EXTERNAL,COUNT_WRITE_ALLOW_WRITE,SUM_TIMER_WRITE_ALLOW_WRITE,MIN_TIMER_WRITE_ALLOW_WRITE,AVG_TIMER_WRITE_ALLOW_WRITE,MAX_TIMER_WRITE_ALLOW_WRITE,COUNT_WRITE_CONCURRENT_INSERT,SUM_TIMER_WRITE_CONCURRENT_INSERT,MIN_TIMER_WRITE_CONCURRENT_INSERT,AVG_TIMER_WRITE_CONCURRENT_INSERT,MAX_TIMER_WRITE_CONCURRENT_INSERT,COUNT_WRITE_DELAYED,SUM_TIMER_WRITE_DELAYED,MIN_TIMER_WRITE_DELAYED,AVG_TIMER_WRITE_DELAYED,MAX_TIMER_WRITE_DELAYED,COUNT_WRITE_LOW_PRIORITY,SUM_TIMER_WRITE_LOW_PRIORITY,MIN_TIMER_WRITE_LOW_PRIORITY,AVG_TIMER_WRITE_LOW_PRIORITY,MAX_TIMER_WRITE_LOW_PRIORITY,COUNT_WRITE_NORMAL,SUM_TIMER_WRITE_NORMAL,MIN_TIMER_WRITE_NORMAL,AVG_TIMER_WRITE_NORMAL,MAX_TIMER_WRITE_NORMAL,COUNT_WRITE_EXTERNAL,SUM_TIMER_WRITE_EXTERNAL,MIN_TIMER_WRITE_EXTERNAL,AVG_TIMER_WRITE_EXTERNAL,MAX_TIMER_WRITE_EXTERNAL,THREAD_ID,NAME,TYPE,PROCESSLIST_ID,PROCESSLIST_USER,PROCESSLIST_HOST,PROCESSLIST_DB,PROCESSLIST_COMMAND,PROCESSLIST_TIME,PROCESSLIST_STATE,PROCESSLIST_INFO,PARENT_THREAD_ID,ROLE,INSTRUMENTED,USER,CURRENT_CONNECTIONS,TOTAL_CONNECTIONS,db_name,table_name,column_name,min_value,max_value,nulls_ratio,avg_length,avg_frequency,hist_size,hist_type,histogram,Host,Db,User,Table_name,Column_name,Timestamp,Column_priv,Host,Db,User,Select_priv,Insert_priv,Update_priv,Delete_priv,Create_priv,Drop_priv,Grant_priv,References_priv,Index_priv,Alter_priv,Create_tmp_table_priv,Lock_tables_priv,Create_view_priv,Show_view_priv,Create_routine_priv,Alter_routine_priv,Execute_priv,Event_priv,Trigger_priv,Delete_history_priv,db,name,body,definer,execute_at,interval_value,interval_field,created,modified,last_executed,starts,ends,status,on_completion,sql_mode,comment,originator,time_zone,character_set_client,collation_connection,db_collation,body_utf8,name,ret,dl,type,event_time,user_host,thread_id,server_id,command_type,argument,domain_id,sub_id,server_id,seq_no,help_category_id,name,parent_category_id,url,help_keyword_id,name,help_topic_id,help_keyword_id,help_topic_id,name,help_category_id,description,example,url,Host,Db,Select_priv,Insert_priv,Update_priv,Delete_priv,Create_priv,Drop_priv,Grant_priv,References_priv,Index_priv,Alter_priv,Create_tmp_table_priv,Lock_tables_priv,Create_view_priv,Show_view_priv,Create_routine_priv,Alter_routine_priv,Execute_priv,Trigger_priv,db_name,table_name,index_name,prefix_arity,avg_frequency,database_name,table_name,index_name,last_update,stat_name,stat_value,sample_size,stat_description,database_name,table_name,last_update,n_rows,clustered_index_size,sum_of_other_index_sizes,name,dl,db,name,type,specific_name,language,sql_data_access,is_deterministic,security_type,param_list,returns,body,definer,created,modified,sql_mode,comment,character_set_client,collation_connection,db_collation,body_utf8,aggregate,Host,Db,User,Routine_name,Routine_type,Grantor,Proc_priv,Timestamp,Host,User,Proxied_host,Proxied_user,With_grant,Grantor,Timestamp,Host,User,Role,Admin_option,Server_name,Host,Db,Username,Password,Port,Socket,Wrapper,Owner,start_time,user_host,query_time,lock_time,rows_sent,rows_examined,db,last_insert_id,insert_id,server_id,sql_text,thread_id,rows_affected,db_name,table_name,cardinality,Host,Db,User,Table_name,Grantor,Timestamp,Table_priv,Column_priv,Time_zone_id,Use_leap_seconds,Transition_time,Correction,Name,Time_zone_id,Time_zone_id,Transition_time,Transition_type_id,Time_zone_id,Transition_type_id,Offset,Is_DST,Abbreviation,transaction_id,commit_id,begin_timestamp,commit_timestamp,isolation_level,Host,User,Password,Select_priv,Insert_priv,Update_priv,Delete_priv,Create_priv,Drop_priv,Reload_priv,Shutdown_priv,Process_priv,File_priv,Grant_priv,References_priv,Index_priv,Alter_priv,Show_db_priv,Super_priv,Create_tmp_table_priv,Lock_tables_priv,Execute_priv,Repl_slave_priv,Repl_client_priv,Create_view_priv,Show_view_priv,Create_routine_priv,Alter_routine_priv,Create_user_priv,Event_priv,Trigger_priv,Create_tablespace_priv,Delete_history_priv,ssl_type,ssl_cipher,x509_issuer,x509_subject,max_questions,max_updates,max_connections,max_user_connections,plugin,authentication_string,password_expired,is_role,default_role,max_statement_time,id,username,password,id,username,password’
}

然后我们发现有个password字段名
因为库名只有一个，password对应的表名应该是最后一个

查询字段值，找到了flag

总结
这里要用到group_concat（）函数，查询所有的表，字段，库。
没有任何难点，学会sql联合查询注入就会做了