Access injection points cannot guess the solution to the field problem

Check a site, find an access injection point, find the background, and guess the table name, but cannot guess the field name. What a cup of cake is this, the door to shell is there, but you don't have the key to opening the door.

 

I thought for a while and couldn't find the key. After years of experience in xxoo, I was told that there would be any information I wanted in cookies?

In the address bar, tap javascript: alert (document. cookie) and press Enter.

:

 

The value of user_name B4dboy is my User Name. Will the value of UserPass be an encrypted password?

Which admin table's field names will be user_name and UserPass?

Happily enter in the address bar:

Http://www.B4dboy.com/Pro.asp? M_class = 1 & id = 183 and exists (select user_name, UserPass from [admin])

Brother bowed his head again with disappointment. (Ps: thinking is not looking for bricks !)

 

 

A flash of light! Will the programmer write the name of the form element as the field name for convenience when writing the login verification and judgment?

In this case, the field name will not be available! With a try, I opened the background address and checked the source code.

I feel hopeful when I see these two names.

Http://www.B4dboy.com/Pro.asp? M_class = 1 & id = 183 and exists (select strName, strPw from [admin])

 

Close the job.

Ps: there is no technical content in the article. I just think that many of my friends will give up when they can't guess the table name or field. We should think of a solution instead of escaping when encountering problems, finally, don't forget to add strName and strPw to your dictionary. /Giggle