Access injection FAQ

Information Source: Ninty s blog

We should have encountered these three problems frequently. I don't know how to deal with these two problems.
The following is my solution. I have a lot of intrusion experience. So if any of you has another method, please tell me how to handle it. Thank you.

Problem 1: When MD5 is obtained but cannot be cracked.

1. If there is code, check whether the code can be spoofed by cookies.
2. Check the code on the background login page. If there is injection during login, inject it directly at login,
Attackers can use something similar to a universal password to bypass user name and password detection. Question 2 is the specific method.

Problem 2: When the Administrator table cannot be guessed

1. If you have any code, you can directly flip the database.
2. If you can find the background and confirm that there is injection in the background login, try to use the universal password or = or directly. Of course, it often does not work.
At this time, we can find a way to get the username and password field of the Administrator table. You can use my ACCESS tool to inject brute-force fields.
If not, you can check the name values of the two elements in HTML.
If you cannot obtain the two fields, see question 3.

If we can get it, we can do the same as normal injection.
Inject data directly in the login box. Because the SQL statements on the login page are generally:
Select * from skadjfkdsfAdmin where username = dd and password = df
It is the same as normal injection, so we only need to add the and condition to the end, because the preceding SQL statement has already been written from xxx
In this way, we can bypass the table name for injection, and use the injection to guess MD5 in one place or, if possible, directly union a piece of data into the background.

Question 3: You can guess the table but cannot guess the column.
1. If there is still injection during background login, try the universal password directly or use union to construct a piece of data. In this way, the column name can be bypassed.
Even the table name is bypassed. You only need to know the name of any table.
2. If the injected address is not logged on to the background, try the ACCESS offset injection. I have never succeeded in looking at the character.


If it still cannot be solved, there seems to be no good solution. Er, the only advantage is the cross-database query and the brute force guess absolute path extended by cross-database.
I personally feel useless .. If you know the absolute path of another database file on the server, you can intrude into another system in another database.