开发学院数据库MySQL Mssql 逆向查询 阅读

Mssql 逆向查询

 2009-05-27 11:18:56 来源:WEB开发网   
核心提示:非常不幸,拿到一个库,Mssql 逆向查询,里面有几百张表,而且很多表都有N多字段,然后遍历整个数据库,回显该关键字在库中所有位置,不想一个一个去手工探测有用的表和字段,写了点SQL语句,在oldjun帮忙下有了这个脚本

非常不幸,拿到一个库,里面有几百张表,而且很多表都有N多字段,不想一个一个去手工探测有用的表和字段,写了点SQL语句,在oldjun帮忙下有了这个脚本。作用是使用一个关键字作为搜索条件,然后遍历整个数据库,回显该关键字在库中所有位置,即所处表名与列。

Mssql 逆向查询

直接给出代码:

<title>Sql逆向查询</title>
<form name="Form" action="?">
<input type="text" name="keyword" value="输入要搜索的关键字">
<input type="Submit" value="提交">
</form>
<%
'Search a keyword from each column in each table of a database
'By oldjun(http://www.oldjun.com)
'Based on huangzi(http://www.2chuizi.com)'s sql
'Respect for the author's work

Server.ScriptTimeout=999999999
Response.Buffer =true
On Error Resume Next
keyword=request("keyword")
if keyword="" then
response.write "Need keyword!"
response.End
End if
dim conn
Set conn = Server.CreateObject("ADODB.Connection")
Dim ConnStr
'ConnectionString,Pls change!
ConnStr="Driver={SQL SERVER};Server=localhost;UID=bbs;PWD=bbs123456789;Database=syc163"
Conn.open ConnStr
conn.execute("DROP TABLE huangzi_table")
conn.execute("CREATE TABLE huangzi_table(id int identity(1,1),biaoid int,biaoname nvarchar(1000))")
conn.execute("insert huangzi_table select [id],[name] from sysobjects where xtype='U'")

set rs =conn.execute("select count(id) as tnum from huangzi_table")
tnum=rs("tnum")
rs.close
set rs=nothing
for i=1 to tnum

set rsbiao =conn.execute("select biaoid from huangzi_table where id="&i&"")
biaoid=rsbiao("biaoid")
set rst =conn.execute("select [biaoname] from huangzi_table where biaoid="&biaoid&"")
tname=rst("biaoname")

set rsl=conn.execute("select count([name]) as lnum from syscolumns where id="&biaoid&"")
lnum=rsl("lnum")

for j=1 to lnum

topnum=j-1
set rslie=conn.execute("select top 1 [name] from syscolumns where id="&biaoid&" and [name] not in (select top "&topnum&" [name] from syscolumns where id="&biaoid&")")
liename=rslie("name")
set rsresult=conn.execute("select top 1 ["&liename&"] from ["&tname&"] where CAST(["&liename&"] AS NVARCHAR(1000))='"&keyword&"'")

if rsresult.bof or rsresult.eof then
'response.write "Nothing-"&tname&":"&liename
'response.write "<br>"
else
result=rsresult(liename)
response.write "表名:"&tname&"    列名:"&liename& "   存在关键字  [" &keyword&"]"
response.write "<br>"
End if

rslie.close
set rslie=nothing
rsresult.close
set rsresult=nothing
next

rsbiao.close
set rsbiao=nothing
rst.close
set rst=nothing
rsl.close
set rsl=nothing
next

conn.execute("DROP TABLE huangzi_table")
%>

Tags:Mssql 逆向 查询

编辑录入:爽爽 [复制链接] [打 印]
[]
  • 好
  • 好的评价 如果觉得好,就请您
      0%(0)
  • 差
  • 差的评价 如果觉得差,就请您
      0%(0)
赞助商链接