Manual injection method, easy to test injection point (including video tutorial)

1, add single quote ' Submit,

Result: An injection vulnerability could be present in the Web site if an error message appears.

2, the digital type to determine whether there is injection; Statement: And 1=1, and 1=2 (Classic), ' and ' 1 ' =1 (character type)

The result: separate pages are returned, indicating an injection vulnerability exists.

Analysis: And the meaning is "and" if we do not filter our statements, and 1=1 will be replaced by SQL query statements to query, if and before and after the two statements are true, there will be no error, but if there is a false statement before and after statements, the program will be critical error. It also indicates that the program has an injection vulnerability

Anti-injection solutions:

1> use or 2>1; or 1>2 to make judgments.

The result: separate pages are returned, indicating an injection vulnerability exists.

Analysis: Or injection only requires two statements before and after a correct is true, if the front and back two statements are correct, but false. Remember: When an OR is injected, the statement after or is returned to the error page if it is correct! If it is an error, the correct page is returned, indicating that there is an injection point.

2> using XOR 1=1; XOR 1=2

The result: separate pages are returned, indicating an injection vulnerability exists.

Analysis: XOR stands for XOR, meaning that the connected expression is only true when one is true. Remember: When XOR is injected, the statement that follows the XOR returns the error page area if it is correct, and, if it is an error, returns the correct page, indicating that there is an injection point.

3> convert and 1=1 to URL encoded form after committing and 1=1 URL encoding:%41%4e%44%20%%31%3d%31

4> using -1;-0

Analysis: If the returned page is different from the previous one, it is another news, it indicates that there is an injection vulnerability, is a digital injection vulnerability; After the URL address, add -0,url to news.asp?id=123-0, the returned page is the same as the previous page, plus-1, return the error page, It also indicates an injection vulnerability exists.

3, the character type to determine whether there is injection:

Statement: ' and ' 1 ' =1; ' and ' 1=2 (classic)

The result: separate pages are returned, indicating an injection vulnerability exists.

Analysis: Adding ' and ' 1 ' = 1 Returns the correct page, adding ' and ' 1=2 return error page, indicating there is an injection leak.

Anti-injection solutions:

Add '%2b ' to the URL's address (character type)

Analysis: The URL changed to: news.asp?id=123 '%2b ', the returned page and 1, plus ' 2%2b ' Asdf,url address changed to: News.asp?id=123 '%2BASDF, the returned page and 1 different, or did not find the record, Or an error, it means that there is an injection point, which is text-based.

The search type determines whether there is an injection:

A simple way to judge the existence of a search injection vulnerability is to search first ', if there is an error, the vulnerability is 90%. Then search%, if normal return, the description 95% has a hole.

Description: Adding special characters such as "&", "[", "]", "%", "$", "@" and so on, can be implemented, if there is an error, it indicates a problem.

Action: Search for a keyword, such as 2006, normal return all 2006 related information, and then search 2006% ' and 1=1 and '% ' = ' and 2006% ' and 1=2 and '% ' = ', there are similarities and differences, that is, 100% have a hole. The keyword% ' and 1=1 and '% ' = '% ' keyword% ' and 1=2 and '% ' = '% will change and 1=1 into the injected statement.

To determine the database type:

and user>0

For example: showdetail.asp?id=49, and user>0 if it is an Access database, then the error returned will generally be "Microsoft JET database" key, if the number of MSSQL The error message returned by the repository will typically contain "SQL Server" key.

Guess table name and exists (SELECT * from table name)

Description: The meaning is the same as above, just use the name of the language is not the same.

Guess column name and (select COUNT (column name) from table name) >0

Description: If we enter the column name guess correct no back to normal page

Guess length and (select top 1 len (username) from admin) >0

Note: If the last data we entered returns an error, and the previous digit of the error is returned correctly, the length of the solution I have guessed is correct.

Guess content and (select top 1 ASC (mid username,1,1) from admin) >50 ASCII code 1-128

Description: If the last data we entered returned an error, and the previous digit of the error was returned correctly, the number I guessed was correct. (You can use the binary method to guess the content)

Binary: The minimum value and the maximum difference of half, such as input 50 is correct, input 100 return error, binary input 75.

Two kinds of common explosive vault

1,%5c

2, conn.asp

%5C Bauku Two-level directory in the middle of/switch to%5c ey:otherweb ... s.asp? Bigclassname= Scope of Responsibility &bigclasstype=1 if you can see: ' E:\ahttc040901 \otherweb\dz\database\ixuer_studio.asa ' is not a valid path. Determine if the path name is spelled correctly and is connected to the server where the file resides. This is the database. When downloading, replace the flashget with the. mdb format.

Conn.asp Bauku This is also a relatively old loophole, the use of small value

Common: ' or ' = ' or ' Universal password login

' or ' = ' or ' This is a language that can connect to SQL. Can be directly into the background. I collected a bit. Similar also to: ' or ' ' = ' or ' a ' = ' a ' or ' (' a ' = ' a ') or ("a" = "a" or "a" = "a" or 1=1--' or ' a ' = ' a very old use method, mainly used for some older sites.

Union Query Injection (union query)

Operation Steps:

1> Add and 1=2 Union select * Form name in the normal statement, where the * number represents the number of fields, from 11 straight append (and 1=2 Union select 1,2,3,4 Form table name) if the number of fields is correct, there will be a critical error.

2> is replaced with the actual field name in the page where the number is displayed, such as: Username,password.

3> The actual Database field value at the page field value.

Video Tutorial Http://edu.aqniu.com/course/83

Chat QQ Group

131068813

Manual injection method, easy to test injection point (including video tutorial)